MIRRORS/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky.git synced 2025-07-19 21:09:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

classes: cve-check: Get shared database lock

Browse Source 
The CVE check database needs to have a shared lock acquired on it before
it is accessed. This to prevent cve-update-db-native from deleting the
database file out from underneath it.

[YOCTO #14899]

(From OE-Core rev: 20a9911b73df62a0d0d1884e57085f13ac5016dd)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Joshua Watt 2022-08-30 10:59:39 -05:00 committed by Richard Purdie
parent 4d756897a4
commit a19e278f2e
1 changed files with 12 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
meta/classes/cve-check.bbclass
View File

@ -145,17 +145,18 @@ python do_cve_check () {
""" """
from oe.cve_check import get_patched_cves from oe.cve_check import get_patched_cves
if os.path.exists(d.getVar("CVE_CHECK_DB_FILE")): with bb.utils.fileslocked([d.getVar("CVE_CHECK_DB_FILE_LOCK")], shared=True):
try: if os.path.exists(d.getVar("CVE_CHECK_DB_FILE")):
patched_cves = get_patched_cves(d) try:
except FileNotFoundError: patched_cves = get_patched_cves(d)
bb.fatal("Failure in searching patches") except FileNotFoundError:
ignored, patched, unpatched, status = check_cves(d, patched_cves) bb.fatal("Failure in searching patches")
if patched or unpatched or (d.getVar("CVE_CHECK_COVERAGE") == "1" and status): ignored, patched, unpatched, status = check_cves(d, patched_cves)
cve_data = get_cve_info(d, patched + unpatched + ignored) if patched or unpatched or (d.getVar("CVE_CHECK_COVERAGE") == "1" and status):
cve_write_data(d, patched, unpatched, ignored, cve_data, status) cve_data = get_cve_info(d, patched + unpatched + ignored)
else: cve_write_data(d, patched, unpatched, ignored, cve_data, status)
bb.note("No CVE database found, skipping CVE check") else:
bb.note("No CVE database found, skipping CVE check")
} }