| Summary: |
Redhat/Fedora Shellshock Fix Leads To oe_terminal breakage |
| Product: |
[Build System, Metadata & Runtime] OE-Core
|
Reporter: |
Christopher Kilgour <chris> |
| Component: |
core | Assignee: |
Richard Purdie <richard.purdie> |
| Status: |
RESOLVED
FIXED
|
QA Contact: |
Lucian Musat <georgex.l.musat> |
| Severity: |
normal
|
|
|
| Priority: |
Medium+
|
CC: |
alexandru.c.georgescu, bluelightning, meta.mr.watcher, meta.watcher, poky.bs.watcher, poky.watcher, sgw
|
| Version: |
unspecified | |
|
| Target Milestone: |
1.8 M2 | |
|
| Hardware: |
x86 | |
|
| OS: |
Multiple | |
|
| Whiteboard: |
|
|
OS type for building Yocto:
|
---
|
Type of Regression:
|
---
|
|---|
|
Verified:
|
|
Documentation change:
|
No (bug/feature does not impact docs)
|
|---|
Fedora/Redhat have adopted a particular fix to cve-2014-7169, commonly known as a part of the shellshock bug, which includes the patches here [1]. As a consequence, terminal spawning is broken for commands like "bitbake virtual/kernel -c menuconfig". The reason is the environment variables exported via poky/meta/classes/terminal.bbclass include names like "BASH_FUNC_xxx()" which bash itself will not interpret. An example offending line in run.do_terminal.<PID> is ... export BASH_FUNC_module()="() { eval `/usr/bin/modulecmd bash $*` \ }" ... Since the bash that is launched in the spawned terminal cannot interpret the offending line, it fails to run. The user is briefly met with a spawned terminal that immediately closes with no indication of the problem. [1] http://www.openwall.com/lists/oss-security/2014/09/25/13