1 Why an applet can't be NOFORK or NOEXEC?
4 interactive: may wait for user input, ^C has to work
5 spawner: "tool PROG ARGS" which changes program state and execs - must fork
6 changes state: e.g. environment, signal handlers
7 alloc+xfunc: xmalloc, then xfunc - leaks memory if xfunc dies
8 open+xfunc: opens fd, then calls xfunc - fd is leaked if xfunc dies
9 leaks: does not free allocated memory or opened fds
10 runner: sometimes may run for long(ish) time, and/or works with network:
11 ^C has to work (cat BIGFILE, chmod -R, ftpget, nc)
13 "runners" can become eligible after shell is taught ^C to interrupt NOFORKs,
14 need to be inspected that they do not fall into alloc+xfunc, open+xfunc,
18 suid: runs under different uid - must fork+exec
20 Why shouldn't be NOFORK/NOEXEC:
21 rare: not started often enough to bother optimizing (example: poweroff)
22 daemon: runs indefinitely; these are also always fit "rare" category
23 longterm: often runs for a long time (many seconds), execing makes
24 memory footprint smaller
25 complex: no immediately obvious reason why NOFORK wouldn't work,
26 but does some non-obvoius operations (example: fuser, lsof, losetup);
27 detailed audit often turns out that it's a leaker
29 Interesting example of "interactive" applet which is nevertheless can be
30 (and is) NOEXEC is "rm". Yes, "rm -i" is interactive - but it's not that typical
31 for users to keep it waiting for many minutes, whereas running "rm" in shell
32 is very typical, and speeding up this common use via NOEXEC is useful.
33 IOW: rm is "interactive", but not "longterm".
39 add-shell - noexec. leaks: open+xfunc
40 addgroup - noexec. leaks
41 adduser - noexec. leaks
47 ash - interactive, longterm
51 beep - longterm: beep -r 999999999
52 blkdiscard - noexec. leaks: open+xioctl
54 blockdev - noexec. leaks fd
60 cal - runner: cal -n9999
62 chat - needs ^C to work
63 chattr - noexec. runner
64 chgrp - noexec. runner
65 chmod - noexec. runner
66 chown - noexec. runner
67 chpasswd - runner (list of "user:password"s from stdin)
68 chpst - noexec. spawner
69 chroot - noexec. spawner
70 chrt - noexec. spawner
71 chvt - noexec. leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds
72 cksum - noexec. runner
76 conspy - interactive, longterm
80 crontab - longterm (runs $EDITOR), leaks: open+xasprintf
81 cryptpw - noexec. changes state: with --password-fd=N, moves N to stdin
82 cttyhack - noexec. spawner
84 date - noexec. nofork candidate(needs to stop messing up env, free xasprintf result, not use xfuncs after xasprintf)
85 dc - runner (eats stdin if no params)
87 deallocvt - noexec. leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds
88 delgroup - noexec. leaks
89 deluser - noexec. leaks
90 depmod - complex, rare
91 devmem - runner, complex (access to device memory may hang)
92 df - leaks: nested allocs
98 dnsdomainname - needs ^C (may talk to DNS servers, which may be down)
99 dos2unix - noexec. runner
102 dumpkmap - noexec. leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds
103 dumpleases - leaks: open+xread
105 ed - interactive, longterm
106 egrep - longterm runner ("CMD | egrep ..." may run indefinitely, better to exec to conserve memory)
107 eject - leaks: open+ioctl_or_perror_and_die, changes state (moves fds)
108 env - noexec. spawner, changes state (env)
109 envdir - noexec. spawner
110 envuidgid - noexec. spawner
112 expr - leaks: nested allocs
113 factor - runner (eats stdin if no params)
116 fatattr - leaks: open+xioctl, complex
117 fbset - leaks: open+xfunc, complex, rare
118 fbsplash - runner, longterm
119 fdflush - leaks: open+ioctl_or_perror_and_die, needs ^C (floppy may be unresponsive), rare
120 fdformat - needs ^C (floppy may be unresponsive), longterm, rare
121 fdisk - interactive, longterm
122 fgconsole - noexec. leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds
123 fgrep - longterm runner ("CMD | fgrep ..." may run indefinitely, better to exec to conserve memory)
124 find - noexec. runner
126 flash_eraseall - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
127 flash_lock - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
128 flash_unlock - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
129 flashcp - needs ^C. could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
130 flock - spawner, changes state (file locks), let's play safe and not be noexec
131 fold - noexec. runner
132 free - nofork candidate(struct globals, needs to close /proc/meminfo fd)
133 freeramdisk - leaks: open+ioctl_or_perror_and_die
134 fsck - interactive, longterm
135 fsck.minix - needs ^C
136 fsfreeze - noexec. leaks: open+xioctl
137 fstrim - noexec. leaks: open+xioctl, find_block_device -> readdir+xstrdup
143 getopt - noexec. leaks: many allocs
144 getty - interactive, longterm
145 grep - longterm runner ("CMD | grep ..." may run indefinitely, better to exec to conserve memory)
151 hdparm - complex, rare
152 head - noexec. runner
153 hexdump - noexec. runner
155 hostname - needs ^C (may talk to DNS servers, which may be down)
157 hush - interactive, longterm
158 hwclock - talks to hardware (xioctl(RTC_RD_TIME)) - needs ^C
164 ifconfig - leaks: xsocket+ioctl_or_perror_and_die
165 ifenslave - leaks: xsocket+bb_perror_msg_and_die
172 ionice - noexec. spawner
174 ip - noexec candidate
175 ipaddr - noexec candidate
176 ipcalc - noexec candidate
177 ipcrm - noexec candidate
178 ipcs - noexec candidate
179 iplink - noexec candidate
180 ipneigh - noexec candidate
181 iproute - noexec candidate
182 iprule - noexec candidate
183 iptunnel - noexec candidate
184 kbd_mode - noexec. leaks: xopen_nonblocking+xioctl
189 last - runner (I've got 1300 lines of output when tried it)
190 less - interactive, longterm
192 linux32 - noexec. spawner
193 linux64 - noexec. spawner
196 loadfont - noexec. leaks: config_open+bb_error_msg_and_die("map format")
197 loadkmap - noexec. leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds
199 login - suid, interactive, longterm
206 lsattr - noexec. runner
209 lspci - noexec. too rare to bother for nofork
210 lsscsi - noexec. too rare to bother for nofork
211 lsusb - noexec. too rare to bother for nofork
218 man - spawner, interactive, longterm
219 md5sum - noexec. runner
222 microcom - interactive, longterm
228 mkfs.minix - needs ^C
231 mkpasswd - noexec. changes state: with --password-fd=N, moves N to stdin
233 mktemp - noexec. leaks: xstrdup+concat_path_file
236 more - interactive, longterm
238 mountpoint - noexec. leaks: option -n "print dev name": find_block_device -> readdir+xstrdup
239 mpstat - longterm: "mpstat 1" runs indefinitely
241 mv - noexec candidate, runner
242 nameif - noexec. openlog(), leaks: config_open2+ioctl_or_perror_and_die
245 netstat - runner with -c
246 nice - noexec. spawner
249 nohup - noexec. spawner
253 openvt - longterm: spawns a child and waits for it
254 partprobe - noexec. leaks: open+ioctl_or_perror_and_die(BLKRRPART)
256 paste - noexec. runner
258 pgrep - nofork candidate(xregcomp, procps_scan - are they ok?)
259 pidof - nofork candidate(uses find_pid_by_name, is that ok?)
262 pipe_progress - longterm
264 pkill - nofork candidate(xregcomp, procps_scan - are they ok?)
265 pmap - noexec candidate, leaks: open+xstrdup
268 powertop - interactive, longterm
271 ps - looks for AT_CLKTCK elf aux vector, therefore can't be noexec
276 raidautorun - noexec. very simple. leaks: open+xioctl
277 rdate - needs ^C (may talk to DNS servers, which may be down)
278 rdev - leaks: find_block_device -> readdir+xstrdup
280 readprofile - reads /boot/System.map and /proc/profile, better to free more memory by execing?
284 remove-shell - noexec. leaks: open+xfunc
285 renice - nofork candidate(uses getpwnam, is that ok?)
286 reset - noexec. spawner (execs "stty")
287 resize - noexec. changes state (signal handlers)
289 rm - noexec. rm -i interactive
292 route - needs ^C (may talk to DNS servers, which may be down)
295 rtcwake - longterm: puts system to sleep, optimizing this for speed is pointless
297 runlevel - noexec. can be nofork if "endutxent()" is called unconditionally, but too rare to bother?
301 script - longterm: pumps script output from slave pty
302 scriptreplay - longterm: plays back "script" saved output, sleeping as necessary.
306 setarch - noexec. spawner
308 setfont - noexec. leaks a lot of stuff
311 setpriv - spawner, changes state, let's play safe and not be noexec
313 setsid - spawner, uses fork_or_rexec() [not audited to work in noexec], let's play safe and not be noexec
314 setuidgid - noexec. spawner
315 sha1sum - noexec. runner
316 sha256sum - noexec. runner
317 sha3sum - noexec. runner
318 sha512sum - noexec. runner
319 showkey - interactive, longterm
321 shuf - noexec. runner
322 slattach - longterm (may sleep forever), uses bb_common_bufsiz1
323 sleep - runner, longterm
325 softlimit - noexec. spawner
326 sort - noexec. runner
328 ssl_client - longterm
329 start-stop-daemon - not noexec: uses bb_common_bufsiz1
330 stat - nofork candidate(needs fewer allocs)
332 stty - noexec. nofork candidate: has no allocs or opens except xmove_fd(xopen("-F DEVICE"),STDIN). tcsetattr(STDIN) is not a problem: it would work the same across processes sharing this fd
334 sulogin - noexec. spawner
336 sv - noexec. needs ^C (uses usleep(420000))
337 svc - noexec. needs ^C (uses usleep(420000))
341 switch_root - spawner, rare, changes state (oh yes), execing may be important to free binary's inode
343 sysctl - noexec. leaks: xstrdup+xmalloc_read
348 taskset - noexec. spawner
351 telnet - interactive, longterm
356 time - spawner, longterm, changes state (signals)
357 timeout - spawner, longterm, changes state (signals)
358 top - interactive, longterm
361 traceroute - suid, runner
362 traceroute6 - suid, runner
368 tune2fs - noexec. leaks: open+xfunc
369 ubiattach - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
370 ubidetach - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
371 ubimkvol - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
372 ubirename - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
373 ubirmvol - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
374 ubirsvol - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
375 ubiupdatevol - could be noexec, but I feel flash ops are risky (prone to hw/fw/sw bugs)
380 umount - noexec. leaks: nested xmalloc
385 unix2dos - noexec. runner
391 uptime - nofork candidate(is getutxent ok?)
392 users - nofork candidate(is getutxent ok?)
396 vconfig - leaks: xsocket+ioctl_or_perror_and_die
397 vi - interactive, longterm
400 w - nofork candidate(is getutxent ok?)
407 who - nofork candidate(is getutxent ok?)
410 xargs - noexec. spawner