[U-Boot] [PATCH] scripts: setlocalversion: safely extract variables from auto.conf using awk

[U-Boot] [PATCH] scripts: setlocalversion: safely extract variables from auto.conf using awk

[Philipp Tomsich]

Moving SPL_LDSCRIPT to Kconfig triggered an unfortunate attempt of
command substitution, as the sourced auto.conf may include $(ARCH)
which tries to execute a command 'ARCH'.
This showed up as a warning similar to the following:
  include/config/auto.conf: line 209: ARCH: command not found

This change does no longer attempt to source auto.conf, but rather
passes it through awk to retrieve the values for CONFIG_LOCALVERSION
and CONFIG_LOCALVERSION_AUTO.  This will also mitigate the risk of
unintended command substitution.

Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
Reported-by: Andy Yan <andy.yan@rock-chips.com>

---

 scripts/setlocalversion | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index 63d91e2..8564bed 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -141,7 +141,11 @@ if $scm_only; then
 fi
 
 if test -e include/config/auto.conf; then
-	. include/config/auto.conf
+	# We are interested only in CONFIG_LOCALVERSION and
+        # CONFIG_LOCALVERSION_AUTO, so extract these in a safe
+        # way (i.e. w/o sourcing auto.conf)
+	CONFIG_LOCALVERSION=`cat include/config/auto.conf | awk -F '=' '/^CONFIG_LOCALVERSION=/ {print $2}'`
+	CONFIG_LOCALVERSION_AUTO=`cat include/config/auto.conf | awk -F '=' '/^CONFIG_LOCALVERSION_AUTO=/ {print $2}'`
 else
 	echo "Error: kernelrelease not valid - run 'make prepare' to update it"
 	exit 1
-- 
2.1.4

[U-Boot] [PATCH] scripts: setlocalversion: safely extract variables from auto.conf using awk

[Tom Rini]

On Tue, Aug 08, 2017 at 03:37:03PM +0200, Philipp Tomsich wrote:

> Moving SPL_LDSCRIPT to Kconfig triggered an unfortunate attempt of
> command substitution, as the sourced auto.conf may include $(ARCH)
> which tries to execute a command 'ARCH'.
> This showed up as a warning similar to the following:
>   include/config/auto.conf: line 209: ARCH: command not found
> 
> This change does no longer attempt to source auto.conf, but rather
> passes it through awk to retrieve the values for CONFIG_LOCALVERSION
> and CONFIG_LOCALVERSION_AUTO.  This will also mitigate the risk of
> unintended command substitution.
> 
> Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
> Reported-by: Andy Yan <andy.yan@rock-chips.com>
> 

Reviewed-by: Tom Rini <trini@konsulko.com>

I do wonder if we can get this into the kernel as well.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170809/aadf262c/attachment.sig>

[U-Boot] scripts: setlocalversion: safely extract variables from auto.conf using awk

[Philipp Tomsich]

> Moving SPL_LDSCRIPT to Kconfig triggered an unfortunate attempt of
> command substitution, as the sourced auto.conf may include $(ARCH)
> which tries to execute a command 'ARCH'.
> This showed up as a warning similar to the following:
>   include/config/auto.conf: line 209: ARCH: command not found
> 
> This change does no longer attempt to source auto.conf, but rather
> passes it through awk to retrieve the values for CONFIG_LOCALVERSION
> and CONFIG_LOCALVERSION_AUTO.  This will also mitigate the risk of
> unintended command substitution.
> 
> Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
> Reported-by: Andy Yan <andy.yan@rock-chips.com>
> Reviewed-by: Tom Rini <trini@konsulko.com>
> ---
> 
>  scripts/setlocalversion | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 

Applied to u-boot-rockchip, thanks!