tar2fs: avoid losetup race

There's a race condition (TOCTOU) between losetup --find and applying the obtained path after additional dd in between; twice awful as *at least* running both losetups closely would reduce the window significantly, and reading the manpage properly back then would eliminate this. Reported-by: Anton Midyukov <antohami@altlinux.org> Suggested-by: Gleb F-Malinovskiy <glebfm@altlinux.org>

tar2fs: avoid losetup race
1a33a37a · Michael Shigorin · Anton Midyukov · e245447c · 1a33a37a
Commit 1a33a37a authored Mar 29, 2022 by Michael Shigorin Committed by Anton Midyukov Apr 05, 2022
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

tar2fs bin/tar2fs +2 -2

No files found.
--- a/bin/tar2fs
+++ b/bin/tar2fs
@@ -165,7 +165,6 @@ for i in losetup sfdisk parted kpartx $MKFS; do
 	fi
 done

-LOOPDEV="$(losetup --find)"	# would be sad about non-binary megabytes too
 ROOTFS="$WORKDIR/chroot"

 BOOTFS=
@@ -204,7 +203,8 @@ trap exit_handler EXIT ERR
 rm -f -- "$IMG"
 OFFSET="$(($CUR_BOUNDARY + $EFIPARTSIZEM + $BOOTLOADERPARTSIZEM + $BOOTSIZEM + $ROOTSIZEM - 1))"
 dd if=/dev/zero of="$IMG" conv=notrunc bs=$MB count=1 seek="$OFFSET"
-losetup "$LOOPDEV" "$IMG"
+losetup -f "$IMG"
+LOOPDEV=$(losetup -j "$IMG" | cut -f 1 -d ':')

 parting mklabel "$PARTTABLE"