Attention is currently required from: Angel Pons, Stefan Reinauer.
Edward O'Callaghan has posted comments on this change. ( https://review.coreboot.org/c/flashrom/+/75194?usp=email )
Change subject: layout.c: Mitigate untrusted FMAP's within fw images address root
......................................................................
Patch Set 2:
(5 comments)
Commit Message:
https://review.coreboot.org/c/flashrom/+/75194/comment/66f2b0c0_59c88885 :
PS1, Line 9: elivated
> elevated
Done
https://review.coreboot.org/c/flashrom/+/75194/comment/12222f6b_8add70d4 :
PS1, Line 9: privilaged
> privileged
Done
https://review.coreboot.org/c/flashrom/+/75194/comment/9ccd9ec3_a959602e :
PS1, Line 13: relative paths however this
> Add some punctuation: […]
Thanks! Done.
https://review.coreboot.org/c/flashrom/+/75194/comment/e3d65221_3b5a8933 :
PS1, Line 14: privilaged
> privileged
Done
File layout.c:
https://review.coreboot.org/c/flashrom/+/75194/comment/3c547ad8_7d1f1584 :
PS1, Line 199: filename[0] == '\\'
> If this is meant to secure DOS/Windows paths, you'd also have to check for "[a-zA-Z]:", […]
I would imagine this whole effort is pointless. If you are running flashrom with root privileges reading untrusted binaries via untrusted programmers you already failed. The proper fix is to drop privileges from flashrom upon invocation.
--
To view, visit https://review.coreboot.org/c/flashrom/+/75194?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: I820ea2dfc25925895b9fb7926d2a337e4f0e3fd2
Gerrit-Change-Number: 75194
Gerrit-PatchSet: 2
Gerrit-Owner: Edward O'Callaghan <quasisec(a)chromium.org>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Comment-Date: Wed, 07 Jun 2023 04:29:04 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Nico Huber <nico.h(a)gmx.de>
Comment-In-Reply-To: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-MessageType: comment
Attention is currently required from: Edward O'Callaghan, Stefan Reinauer.
Hello Angel Pons, Stefan Reinauer, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/flashrom/+/75194?usp=email
to look at the new patch set (#2).
Change subject: layout.c: Mitigate untrusted FMAP's within fw images address root
......................................................................
layout.c: Mitigate untrusted FMAP's within fw images address root
A ill informed security engineer running a elevated privileged
version of flashrom that parses a embedded FMAP within the image
could find themseleves addressing absolute system paths. We
can mitigate this by ensuring paths in the FMAP are always
relative paths. However, this does not address the deeper issue
of parsing untrusted data with a privileged process which is
user error. Do not run flashrom as root unless you require
the internal programmer in which case the internal image is
implicitly trusted.
Change-Id: I820ea2dfc25925895b9fb7926d2a337e4f0e3fd2
Signed-off-by: Edward O'Callaghan <quasisec(a)google.com>
---
M layout.c
1 file changed, 3 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/flashrom refs/changes/94/75194/2
--
To view, visit https://review.coreboot.org/c/flashrom/+/75194?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: I820ea2dfc25925895b9fb7926d2a337e4f0e3fd2
Gerrit-Change-Number: 75194
Gerrit-PatchSet: 2
Gerrit-Owner: Edward O'Callaghan <quasisec(a)chromium.org>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Edward O'Callaghan <quasisec(a)chromium.org>
Gerrit-MessageType: newpatchset
Attention is currently required from: Alexander Goncharov, Anastasia Klimchuk, Miklós Márton, Thomas Heijligen.
Peter Marheine has posted comments on this change. ( https://review.coreboot.org/c/flashrom/+/75270?usp=email )
Change subject: doc: Add build instructions for NI-845x on Windows
......................................................................
Patch Set 7: Code-Review+2
(1 comment)
File doc/dev_guide/building_from_source.rst:
https://review.coreboot.org/c/flashrom/+/75270/comment/152efa08_868b17a3 :
PS5, Line 17: * linux-headers†
: * libpci†
: * libusb1†
: * libftdi1†
: * libjaylink†
: * NI-845x driver & library package‡
:
: | \* optional, for building unit testing
: | † optional, depending on the selected programmer
: | ‡ optional, proprietary and Windows only. (See Windows build instructions)
> This is exactly what Sphinx gives us - `footnote-but-place-it-after-this-paragraph`! I've uploaded t […]
Huh, it wasn't clear from the documentation that you can do that (or that it's the normal behavior?). Neat.
--
To view, visit https://review.coreboot.org/c/flashrom/+/75270?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: I97ad08632f35aa241b3d19d9ce7711146e3f1f4a
Gerrit-Change-Number: 75270
Gerrit-PatchSet: 7
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Reviewer: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Attention: Thomas Heijligen <src(a)posteo.de>
Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Attention: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Comment-Date: Tue, 06 Jun 2023 00:55:42 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: Peter Marheine <pmarheine(a)chromium.org>
Comment-In-Reply-To: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-MessageType: comment
Attention is currently required from: Anastasia Klimchuk, Miklós Márton, Peter Marheine, Thomas Heijligen.
Alexander Goncharov has posted comments on this change. ( https://review.coreboot.org/c/flashrom/+/75270?usp=email )
Change subject: doc: Add build instructions for NI-845x on Windows
......................................................................
Patch Set 7:
(1 comment)
File doc/dev_guide/building_from_source.rst:
https://review.coreboot.org/c/flashrom/+/75270/comment/1cb48366_af287e71 :
PS5, Line 17: * linux-headers†
: * libpci†
: * libusb1†
: * libftdi1†
: * libjaylink†
: * NI-845x driver & library package‡
:
: | \* optional, for building unit testing
: | † optional, depending on the selected programmer
: | ‡ optional, proprietary and Windows only. (See Windows build instructions)
> I thought it made more sense to keep these near the list, since it seems unnecessarily difficult to […]
This is exactly what Sphinx gives us - `footnote-but-place-it-after-this-paragraph`! I've uploaded the new patchset, please check it out.
--
To view, visit https://review.coreboot.org/c/flashrom/+/75270?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: I97ad08632f35aa241b3d19d9ce7711146e3f1f4a
Gerrit-Change-Number: 75270
Gerrit-PatchSet: 7
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Reviewer: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Attention: Thomas Heijligen <src(a)posteo.de>
Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Attention: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Comment-Date: Mon, 05 Jun 2023 07:57:36 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Peter Marheine <pmarheine(a)chromium.org>
Comment-In-Reply-To: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-MessageType: comment
Attention is currently required from: Alexander Goncharov, Anastasia Klimchuk, Miklós Márton, Peter Marheine.
Alexander Goncharov has uploaded a new patch set (#7) to the change originally created by Thomas Heijligen. ( https://review.coreboot.org/c/flashrom/+/75270?usp=email )
Change subject: doc: Add build instructions for NI-845x on Windows
......................................................................
doc: Add build instructions for NI-845x on Windows
Because this patch adds a new footprint level, Sphinx incorrectly
interprets the 3 asterisks (***) as the start of a bold block,
rather than a footnote marker. To work around this, use sphinx
built-in footprints.
Change-Id: I97ad08632f35aa241b3d19d9ce7711146e3f1f4a
Signed-off-by: Thomas Heijligen <thomas.heijligen(a)secunet.com>
Signed-off-by: Peter Marheine <pmarheine(a)chromium.org>
Signed-off-by: Alexander Goncharov <chat(a)joursoir.net>
---
M doc/dev_guide/building_from_source.rst
M doc/dev_guide/building_with_make.rst
2 files changed, 25 insertions(+), 8 deletions(-)
git pull ssh://review.coreboot.org:29418/flashrom refs/changes/70/75270/7
--
To view, visit https://review.coreboot.org/c/flashrom/+/75270?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: I97ad08632f35aa241b3d19d9ce7711146e3f1f4a
Gerrit-Change-Number: 75270
Gerrit-PatchSet: 7
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Reviewer: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Attention: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Attention: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-MessageType: newpatchset
Attention is currently required from: Alexander Goncharov, Anastasia Klimchuk, Miklós Márton, Peter Marheine, Thomas Heijligen.
Alexander Goncharov has uploaded a new patch set (#6) to the change originally created by Thomas Heijligen. ( https://review.coreboot.org/c/flashrom/+/75270?usp=email )
The following approvals got outdated and were removed:
Code-Review+2 by Miklós Márton, Verified+1 by build bot (Jenkins)
The change is no longer submittable: Code-Review and Verified are unsatisfied now.
Change subject: doc: Add build instructions for NI-845x on Windows
......................................................................
doc: Add build instructions for NI-845x on Windows
Change-Id: I97ad08632f35aa241b3d19d9ce7711146e3f1f4a
Signed-off-by: Thomas Heijligen <thomas.heijligen(a)secunet.com>
Signed-off-by: Peter Marheine <pmarheine(a)chromium.org>
Signed-off-by: Alexander Goncharov <chat(a)joursoir.net>
---
M doc/dev_guide/building_from_source.rst
M doc/dev_guide/building_with_make.rst
2 files changed, 25 insertions(+), 8 deletions(-)
git pull ssh://review.coreboot.org:29418/flashrom refs/changes/70/75270/6
--
To view, visit https://review.coreboot.org/c/flashrom/+/75270?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: I97ad08632f35aa241b3d19d9ce7711146e3f1f4a
Gerrit-Change-Number: 75270
Gerrit-PatchSet: 6
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Reviewer: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Attention: Thomas Heijligen <src(a)posteo.de>
Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Attention: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Attention: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-MessageType: newpatchset
Attention is currently required from: Alexander Goncharov, Anastasia Klimchuk, Peter Marheine, Thomas Heijligen.
Miklós Márton has posted comments on this change. ( https://review.coreboot.org/c/flashrom/+/75270?usp=email )
Change subject: doc: Add build instructions for NI-845x on Windows
......................................................................
Patch Set 5: Code-Review+2
--
To view, visit https://review.coreboot.org/c/flashrom/+/75270?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: I97ad08632f35aa241b3d19d9ce7711146e3f1f4a
Gerrit-Change-Number: 75270
Gerrit-PatchSet: 5
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Reviewer: Miklós Márton <martonmiklosqdev(a)gmail.com>
Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Attention: Thomas Heijligen <src(a)posteo.de>
Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>
Gerrit-Attention: Peter Marheine <pmarheine(a)chromium.org>
Gerrit-Attention: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Comment-Date: Mon, 05 Jun 2023 07:24:24 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment