diff options
| author | Henrique de Moraes Holschuh <henrique@nic.br> | 2019-10-18 08:31:30 -0300 |
|---|---|---|
| committer | Petr Štetiar <ynezz@true.cz> | 2019-11-07 22:50:16 +0100 |
| commit | ad7c6102f2098c3dc8233e4590ac47753dc4900d (patch) | |
| tree | f18aaaa8147b8db2ecdea5bff235babdadd05c63 /package/utils/busybox | |
| parent | 22b8a6263d72bb1911c5841ef90ebdf452b53905 (diff) | |
| download | upstream-ad7c6102f2098c3dc8233e4590ac47753dc4900d.tar.gz upstream-ad7c6102f2098c3dc8233e4590ac47753dc4900d.tar.bz2 upstream-ad7c6102f2098c3dc8233e4590ac47753dc4900d.zip | |
busybox: fix missing install with suid bit set if FEATURE_SUID=y
With FEATURE_SUID=y one can install busybox binary belonging to root
with the suid bit set, enabling some applets to perform root-level
operations even when run by ordinary users. Busybox then drops
privileges for applets that don't need root access, before entering
their main() function.
Currently we don't install busybox binary with suid bit set, rendering
this feature unusable.
Note that we can't just "chmod u+s /bin/busybox" at runtime as a
"cheaper" solution: it would waste approximately 200KiB of FLASH (the
whole /bin/busybox binary gets copied into the overlay).
Ref: PR#2502
Signed-off-by: Henrique de Moraes Holschuh <henrique@nic.br>
[commit title/description facelift, use INSTALL_SUID variable]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Diffstat (limited to 'package/utils/busybox')
| -rw-r--r-- | package/utils/busybox/Makefile | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/package/utils/busybox/Makefile b/package/utils/busybox/Makefile index 1e1712fe71..1046d68d3e 100644 --- a/package/utils/busybox/Makefile +++ b/package/utils/busybox/Makefile @@ -114,6 +114,9 @@ ifneq ($(CONFIG_BUSYBOX_$(BUSYBOX_SYM)_NTPD),) $(INSTALL_BIN) ./files/sysntpd $(1)/etc/init.d/sysntpd $(INSTALL_BIN) ./files/ntpd-hotplug $(1)/usr/sbin/ntpd-hotplug endif +ifneq ($(CONFIG_BUSYBOX_$(BUSYBOX_SYM)_FEATURE_SUID),) + $(INSTALL_SUID) $(PKG_INSTALL_DIR)/bin/busybox $(1)/bin/busybox +endif -rm -rf $(1)/lib64 endef |