<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Nov 13, 2017 at 7:10 PM, Christopher Larson <span dir="ltr"><<a href="mailto:kergoth@gmail.com" target="_blank">kergoth@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Mon, Nov 13, 2017 at 11:17 AM, Martyn Welch <span dir="ltr"><<a href="mailto:martyn@welchs.me.uk" target="_blank">martyn@welchs.me.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">From: Fabien Lahoudere <<a href="mailto:fabien.lahoudere@collabora.co.uk" target="_blank">fabien.lahoudere@collabora.co<wbr>.uk</a>><br>
<br>
Sometimes we wish to ensure that packages don't install files or<br>
directories somewhere that may prove detrimental to the operation of the<br>
system. For example, this may be the case if files are placed in a<br>
directory that is utilised as a mount point at run time, thus making them<br>
inaccessible once when the mount point is being utilised.<br>
<br>
Implement the prohibited-path QA test, which enables such locations to be<br>
specified in a "PROHIBITED_PATH" variable. This implementation allows for<br>
exact matches and simple wildcards (paths ending with an asterisk. An<br>
error will be raised should a match be found, or in the case of a<br>
wildcard, for any files added below the specificed location(s).<br>
<br>
Signed-off-by: Fabien Lahoudere <<a href="mailto:fabien.lahoudere@collabora.co.uk" target="_blank">fabien.lahoudere@collabora.co<wbr>.uk</a>><br>
Signed-off-by: Martyn Welch <<a href="mailto:martyn@welchs.me.uk" target="_blank">martyn@welchs.me.uk</a>><br>
---<br>
meta/classes/insane.bbclass | 2 +-<br>
meta/classes/package.bbclass | 11 +++++++++++<br>
2 files changed, 12 insertions(+), 1 deletion(-)<br>
<br>
diff --git a/meta/classes/insane.bbclass b/meta/classes/insane.bbclass<br>
index def9c70..fb10681 100644<br>
--- a/meta/classes/insane.bbclass<br>
+++ b/meta/classes/insane.bbclass<br>
@@ -33,7 +33,7 @@ ERROR_QA ?= "dev-so debug-deps dev-deps debug-files arch pkgconfig la \<br>
perms dep-cmp pkgvarcheck perm-config perm-line perm-link \<br>
split-strip packages-list pkgv-undefined var-undefined \<br>
version-going-backwards expanded-d invalid-chars \<br>
- license-checksum dev-elf file-rdeps \<br>
+ license-checksum dev-elf file-rdeps prohibited-path \<br>
"<br>
# Add usrmerge QA check based on distro feature<br>
ERROR_QA_append = "${@bb.utils.contains('DISTRO_<wbr>FEATURES', 'usrmerge', ' usrmerge', '', d)}"<br>
diff --git a/meta/classes/package.bbclass b/meta/classes/package.bbclass<br>
index 2053d46..721ca1e 100644<br>
--- a/meta/classes/package.bbclass<br>
+++ b/meta/classes/package.bbclass<br>
@@ -1162,6 +1162,17 @@ python populate_packages () {<br>
continue<br>
seen.append(file)<br>
<br>
+ prohibited_path = d.getVar('PROHIBITED_PATH')<br>
+ if prohibited_path is not None:<br>
+ for p in prohibited_path.split():<br>
+ exactmatch = True<br>
+ if p.endswith("*"):<br>
+ p = p[:len(p)-1]<br>
+ exactmatch = False<br>
+ if file[1:].startswith(p) and ((file[1:] != p) or exactmatch) :<br>
+ msg = "%s is in a prohibited path.\n" % file[1:]<br>
+ package_qa_handle_error("prohi<wbr>bited-path", msg, d)<br></blockquote><div><br></div></div></div><div>Unless I’m missing something, you aren’t checking for startswith(p + os.sep), so a file in libexec would match a prohibited path of lib, as it’d still start with that, no?</div></div></div></div></blockquote><div><br></div><div>You might also consider some form of path normalization if you’re comparing directly like this, otherwise i.e. //foo wouldn’t match /foo, even though it’s the same path.</div></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">Christopher Larson<br>kergoth at gmail dot com<br>Founder - BitBake, OpenEmbedded, OpenZaurus<br>Senior Software Engineer, Mentor Graphics</div></div></div></div>
</div></div>