Re: [RFA] .gdbinit security (revived) [incl doc]

Jan Kratochvil
2010-11-20T02:50:54Z

On Sat, 20 Nov 2010 00:06:15 +0100, Keith Seitz wrote:
> --- cli/cli-cmds.h 2 May 2010 23:52:14 -0000 1.16
> +++ cli/cli-cmds.h 19 Nov 2010 22:38:54 -0000
> @@ -126,7 +126,8 @@ extern void source_script (char *, int);
> /* Exported to objfiles.c. */
>
> extern int find_and_open_script (const char *file, int search_path,
> - FILE **streamp, char **full_path);
> + FILE **streamp, char **full_path,
> + int from_tty);

./python/py-auto-load.c: In function ‘source_section_scripts’:
./python/py-auto-load.c:222:10: error: too few arguments to function ‘find_and_open_script’
./cli/cli-cmds.h:128:12: note: declared here

> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ testsuite/gdb.base/gdbinit.exp 19 Nov 2010 22:38:55 -0000

> +global GDB
> +global GDBFLAGS
> +global gdb_prompt
> +global gdb_spawn_id;

Redundant.

> +set env(HOME) [pwd]

Some other env vars from default_gdb_start are missing there.

At least TERM will fix up gdb.log:
-^[[?1034hGNU gdb (GDB) 7.2.50.20101120-cvs^M
+GNU gdb (GDB) 7.2.50.20101120-cvs^M

And there were some reason even for the others:
set env(LC_CTYPE) C
set env(INPUTRC) "/dev/null"
set env(TERM) "vt100"

> +remote_exec build "rm .gdbinit"

Shouldn't be `rm -f' here? (Also for `cp' and `chmod' below.)

This way it deletes src-shipped `gdb/testsuite/.gdbinit' when you run the test
in the src tree.

> +remote_exec build "cp $srcdir/$subdir/gdbinit.sample .gdbinit"

> +gdb_expect 360 {

I would prefer
gdb_test_multiple "" testname
(and thus also dropping the "timeout" case)

> + -re "warning: file .*\.gdbinit.* is untrusted.*Read file anyway\?.*" {

Backslashes should be doubled here in "..." to have the desired effect (and not
considered as a regex metacharacter).

> +gdb_expect 360 {

gdb_test_multiple again.

> + -re "warning: file.*\.gdbinit.* is untrusted.*Read file anyway\?.*" {

Backslashes again.

> + fail "trusted .gdbinit allowed."
> + }
> + -re ".*reading gdbinit.*$gdb_prompt $" {

Redundant leading `.*'.

Thanks,
Jan