mirror of
https://git.proxmox.com/git/fwupd
synced 2025-06-12 19:34:28 +00:00
47efacfe5d
We used the firmware builder functionality to either build or modify firmware images on the end-user system, e.g. copying the MAC address from the old system image to the new system image. Unfortunately running fwupd on the command line (e.g. ./src/fwupd) leaves the tty connected and thus bubblewrap doesn't protect us from installing malicious signed firmware. The firmware would have to have been uploaded to the LVFS by a trusted vendor and signed before being installed, which further decreases the severity of this problem. As there was only one vendor who asked for this functionality (who have yet to upload a single firmware to the LVFS...) just rip out this functionality to reduce our attack surface and completely fix the bug, and any like it. Many thanks to Aaron Janse <aaron@ajanse.me> for discovering and disclosing this issue to us.
180 lines
3.1 KiB
Plaintext
180 lines
3.1 KiB
Plaintext
_fwupdtool_cmd_list=(
|
|
'activate'
|
|
'build-firmware'
|
|
'clear-history'
|
|
'esp-list'
|
|
'esp-mount'
|
|
'esp-unmount'
|
|
'firmware-build'
|
|
'firmware-convert'
|
|
'firmware-export'
|
|
'firmware-extract'
|
|
'firmware-parse'
|
|
'firmware-sign'
|
|
'firmware-patch'
|
|
'get-bios-setting'
|
|
'get-updates'
|
|
'get-upgrades'
|
|
'get-details'
|
|
'get-firmware-types'
|
|
'get-device-flags'
|
|
'get-devices'
|
|
'get-history'
|
|
'get-plugins'
|
|
'get-remotes'
|
|
'get-topology'
|
|
'hwids'
|
|
'update'
|
|
'upgrade'
|
|
'install'
|
|
'install-blob'
|
|
'monitor'
|
|
'reinstall'
|
|
'security'
|
|
'set-bios-setting'
|
|
'switch-branch'
|
|
'self-sign'
|
|
'smbios-dump'
|
|
'attach'
|
|
'detach'
|
|
'firmware-dump'
|
|
'firmware-read'
|
|
'refresh'
|
|
'verify-update'
|
|
'watch'
|
|
'unbind-driver'
|
|
'bind-driver'
|
|
'export-hwids'
|
|
)
|
|
|
|
_fwupdtool_opts=(
|
|
'--verbose'
|
|
'--allow-reinstall'
|
|
'--allow-older'
|
|
'--force'
|
|
'--show-all'
|
|
'--plugins'
|
|
'--prepare'
|
|
'--cleanup'
|
|
'--filter'
|
|
'--method'
|
|
'--disable-ssl-strict'
|
|
'--no-safety-check'
|
|
'--ignore-checksum'
|
|
'--ignore-vid-pid'
|
|
)
|
|
|
|
_show_filters()
|
|
{
|
|
local flags
|
|
flags="$(command fwupdtool get-device-flags 2>/dev/null)"
|
|
COMPREPLY+=( $(compgen -W "${flags}" -- "$cur") )
|
|
}
|
|
|
|
_show_firmware_types()
|
|
{
|
|
local firmware_types
|
|
firmware_types="$(command fwupdtool get-firmware-types 2>/dev/null)"
|
|
COMPREPLY+=( $(compgen -W "${firmware_types}" -- "$cur") )
|
|
}
|
|
|
|
_show_device_ids()
|
|
{
|
|
if ! command -v jq &> /dev/null; then
|
|
return 0
|
|
fi
|
|
local description
|
|
description="$(command jq '.Devices | .[] | .DeviceId' @localstatedir@/cache/fwupd/devices.json 2>/dev/null)"
|
|
COMPREPLY+=( $(compgen -W "${description}" -- "$cur") )
|
|
}
|
|
|
|
_show_plugins()
|
|
{
|
|
if ! command -v jq &> /dev/null; then
|
|
return 0
|
|
fi
|
|
local plugins
|
|
plugins="$(command fwupdtool get-plugins --json 2>/dev/null | jq '.Plugins | .[] | .Name')"
|
|
COMPREPLY+=( $(compgen -W "${plugins}" -- "$cur") )
|
|
}
|
|
|
|
_show_modifiers()
|
|
{
|
|
COMPREPLY+=( $(compgen -W '${_fwupdtool_opts[@]}' -- "$cur") )
|
|
}
|
|
|
|
_fwupdtool()
|
|
{
|
|
local cur prev command arg args
|
|
COMPREPLY=()
|
|
_get_comp_words_by_ref cur prev
|
|
_get_first_arg
|
|
_count_args
|
|
|
|
case $prev in
|
|
--plugins)
|
|
_show_plugins
|
|
return 0
|
|
;;
|
|
--filter)
|
|
_show_filters
|
|
return 0
|
|
;;
|
|
esac
|
|
|
|
case $arg in
|
|
get-details|install|install-blob|firmware-dump|firmware-read)
|
|
#find files
|
|
if [[ "$args" = "2" ]]; then
|
|
_filedir
|
|
#device ID
|
|
elif [[ "$args" = "3" ]]; then
|
|
_show_device_ids
|
|
fi
|
|
;;
|
|
attach|detach|activate|verify-update|reinstall|get-updates)
|
|
#device ID
|
|
if [[ "$args" = "2" ]]; then
|
|
_show_device_ids
|
|
fi
|
|
;;
|
|
firmware-parse|firmware-patch)
|
|
#find files
|
|
if [[ "$args" = "2" ]]; then
|
|
_filedir
|
|
#firmware_type
|
|
elif [[ "$args" = "3" ]]; then
|
|
_show_firmware_types
|
|
fi
|
|
;;
|
|
firmware-convert)
|
|
#file in
|
|
if [[ "$args" = "2" ]]; then
|
|
_filedir
|
|
#file out
|
|
elif [[ "$args" = "3" ]]; then
|
|
_filedir
|
|
#firmware_type in
|
|
elif [[ "$args" = "4" ]]; then
|
|
_show_firmware_types
|
|
#firmware_type out
|
|
elif [[ "$args" = "5" ]]; then
|
|
_show_firmware_types
|
|
fi
|
|
;;
|
|
*)
|
|
#find first command
|
|
if [[ "$args" = "1" ]]; then
|
|
COMPREPLY=( $(compgen -W '${_fwupdtool_cmd_list[@]}' -- "$cur") )
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
#modifiers
|
|
_show_modifiers
|
|
|
|
return 0
|
|
}
|
|
|
|
complete -F _fwupdtool fwupdtool
|