Harden utils

.github/workflows/test.yaml

@@ -14,7 +14,6 @@ jobs:
       fail-fast: true
 
     runs-on: ubuntu-latest
-    if: github.event.pull_request.draft == false
 
     steps:
       - name: Allow unprivileged user namespaces (for Ubuntu 24.04)
@@ -26,7 +25,7 @@ jobs:
           sudo apt-get install expect mergerfs attr pandoc
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -107,7 +106,6 @@ jobs:
       fail-fast: false
 
     runs-on: ubuntu-latest
-    if: github.event.pull_request.draft == false
 
     steps:
       - name: Allow unprivileged user namespaces (for Ubuntu 24.04)
@@ -119,7 +117,7 @@ jobs:
           sudo apt-get install expect mergerfs attr pandoc
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -162,7 +160,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -172,7 +170,7 @@ jobs:
   trycase-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -181,11 +179,10 @@ jobs:
 
   version-check:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.draft == false
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -196,7 +193,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -212,7 +209,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 

Makefile.in

@@ -9,6 +9,7 @@ CC=@CC@
 endif
 CFLAGS=@CFLAGS@
 CPPFLAGS=@CPPFLAGS@
+LDFLAGS=@LDFLAGS@
 INSTALL=@INSTALL@
 
 .PHONY: all install test dist lint clean
@@ -55,13 +56,13 @@ man/try.1: docs/try.1.md
 	pandoc --standalone --from markdown-smart --to man $< -o $@
 
 utils/try-summary: utils/excludes.o utils/try-summary.o
-	$(CC) $(CPPFLAGS) $(CFLAGS) -o $@ -g $^
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ -g $^
 
 utils/try-commit: utils/excludes.o utils/try-commit.o
-	$(CC) $(CPPFLAGS) $(CFLAGS) -o $@ -g $^
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ -g $^
 
 utils/make-socket: utils/make-socket.o
-	$(CC) $(CPPFLAGS) $(CFLAGS) -o $@ -g $^
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ -g $^
 
 test: try $(if $(findstring yes,@enable_utils@),utils/try-summary utils/try-commit) utils/make-socket
 	scripts/run_tests.sh

configure.ac

@@ -13,21 +13,26 @@ AC_ARG_ENABLE([utils],
 
 AC_REQUIRE_AUX_FILE([utils/make-socket.c])
 
-# build tools
-AC_PROG_CC
-
-# CFLAGS AND CPPFLAGGS
-AUTO_CFLAGS=""
-AUTO_CPPFLAGS=""
 
 if test "$enable_utils" = "yes"
 then
-    AC_REQUIRE_AUX_FILE([utils/try-commit.c])
+	AC_REQUIRE_AUX_FILE([utils/try-commit.c])
+
+	# -O2 is required for -D_FORTIFY_SOURCE to do anything; -U_FORTIFY_SOURCE
+	# first avoids a redefinition warning on distros whose GCC predefines it.
+	AUTO_CFLAGS="-O2 -Wall -Wextra -Werror -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fPIE"
+	AUTO_CPPFLAGS=""
+	AUTO_LDFLAGS="-pie -Wl,-z,relro,-z,now"
 
 	CFLAGS=${CFLAGS-"$AUTO_CFLAGS"}
 	CPPFLAGS=${CPPFLAGS-"$AUTO_CPPFLAGS"}
+	LDFLAGS=${LDFLAGS-"$AUTO_LDFLAGS"}
 	AC_SUBST(CFLAGS)
 	AC_SUBST(CPPFLAGS)
+	AC_SUBST(LDFLAGS)
+
+        # build tools
+        AC_PROG_CC
 
 	# needed C types
 	AC_TYPE_PID_T

utils/excludes.c

@@ -6,13 +6,13 @@
 
 static regex_t *excludes = NULL;
 static size_t excludes_len = 0;
-static int num_excludes = 0;
+static size_t num_excludes = 0;
 static regex_t *includes = NULL;
 static size_t includes_len = 0;
-static int num_includes = 0;
+static size_t num_includes = 0;
 
 int should_exclude(char *filename) {
-  for (int i = 0; i < num_excludes; i += 1) {
+  for (size_t i = 0; i < num_excludes; i += 1) {
     if (regexec(&excludes[i], filename, 0, NULL, 0) == 0) {
       return 1;
     }
@@ -26,7 +26,7 @@ int should_include(char *filename) {
     return 1;
   }
 
-  for (int i = 0; i < num_includes; i += 1) {
+  for (size_t i = 0; i < num_includes; i += 1) {
     if (regexec(&includes[i], filename, 0, NULL, 0) == 0) {
       return 1;
     }
@@ -114,7 +114,7 @@ void load_includes(char *progname, char *include_filename) {
 }
 
 void free_excludes() {
-  for (int i = 0; i < num_excludes; i += 1) {
+  for (size_t i = 0; i < num_excludes; i += 1) {
     regfree(&excludes[i]);
   }
   free(excludes);
@@ -124,7 +124,7 @@ void free_excludes() {
 }
 
 void free_includes() {
-  for (int i = 0; i < num_includes; i += 1) {
+  for (size_t i = 0; i < num_includes; i += 1) {
     regfree(&includes[i]);
   }
   free(includes);

utils/try-commit.c

@@ -7,6 +7,7 @@
 #include <linux/limits.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdnoreturn.h>
 #include <string.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -31,7 +32,9 @@ void run(char *argv[], char *file) {
 
     if (pid == 0) {
       execvp(argv[0], argv);
-      return; // unreachable
+      // reachable only when we can't exec `argv[0]`
+      fprintf(stderr, "try-commit: couldn't run '%s': %s\n", argv[0], strerror(errno));
+      _exit(127);
     }
 
     int status = -1;
@@ -77,7 +80,7 @@ void remove_local(char *local_file, int local_exists, struct stat *local_stat) {
   }
 }
 
-void usage(int status) {
+noreturn void usage(int status) {
   fprintf(stderr, "Usage: try-commit [-c] [-E EXCLUDE_FILE] [-I INCLUDE_FILE] SANDBOX_DIR\n");
   fprintf(stderr, "\t-c\tcopy files instead of moving them\n");
   exit(status);
@@ -237,12 +240,12 @@ int main(int argc, char *argv[]) {
       }
 
       char *tgt = malloc(sizeof(char) * tgt_len);
-      int nbytes = readlink(ent->fts_path, tgt, tgt_len);
+      ssize_t nbytes = readlink(ent->fts_path, tgt, tgt_len);
       if (nbytes == -1) {
         commit_error(ent->fts_path, "ln -s");
       }
 
-      while (nbytes == tgt_len) {
+      while ((size_t) nbytes == tgt_len) {
         tgt_len *= 2;
         tgt = realloc(tgt, sizeof(char) * tgt_len);
         nbytes = readlink(ent->fts_path, tgt, tgt_len);

utils/try-summary.c

@@ -6,6 +6,7 @@
 #include <getopt.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdnoreturn.h>
 #include <string.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -27,7 +28,7 @@ void show_change(char *local_file, char *msg) {
   fputs(")\n", stdout);
 }
 
-void usage(int status) {
+noreturn void usage(int status) {
   fprintf(stderr, "Usage: try-summary [-q] [-E EXCLUDE_FILE] [-I INCLUDE_FILE] SANDBOX_DIR\n");
   exit(status);
 }