瀏覽代碼

fs/tar: only store numeric uid/gid

If a target user is asigned a UID (e.g. 1000) that happens to also exist
on the build machine, tar will happily store the username for that user.

This can be seen by some as potential information disclosure.

Instruct tar to just store the numeric uid/gid.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Yann E. MORIN 10 年之前
父節點
當前提交
66ee6dc872
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      fs/tar/tar.mk

+ 1 - 1
fs/tar/tar.mk

@@ -7,7 +7,7 @@
 TAR_OPTS := $(call qstrip,$(BR2_TARGET_ROOTFS_TAR_OPTIONS))
 TAR_OPTS := $(call qstrip,$(BR2_TARGET_ROOTFS_TAR_OPTIONS))
 
 
 define ROOTFS_TAR_CMD
 define ROOTFS_TAR_CMD
-	tar -c$(TAR_OPTS)f $@ -C $(TARGET_DIR) .
+	tar -c$(TAR_OPTS)f $@ --numeric-owner -C $(TARGET_DIR) .
 endef
 endef
 
 
 $(eval $(call ROOTFS_TARGET,tar))
 $(eval $(call ROOTFS_TARGET,tar))