!42 mount sysfs and proc with noguid, nodev and noexec mode

From: @zhangqiumiao 
Reviewed-by: @t_feng 
Signed-off-by: @t_feng

0004-fix-missing-quotation-in-filetransfer.sh.patch

@@ -0,0 +1,46 @@
+From b0c97adfda1dd3281e56e0813f9f1198af0b10d0 Mon Sep 17 00:00:00 2001
+From: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+Date: Fri, 26 May 2023 22:24:51 +0800
+Subject: [PATCH] fix missing quotation in filetransfer.sh
+
+---
+ usr/Euler/project/load/filetransfer.sh | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/usr/Euler/project/load/filetransfer.sh b/usr/Euler/project/load/filetransfer.sh
+index 7066f25..7aa479d 100644
+--- a/usr/Euler/project/load/filetransfer.sh
++++ b/usr/Euler/project/load/filetransfer.sh
+@@ -72,7 +72,7 @@ function mountDirectory()
+     mountCheckPath="`echo $mountpoint | sed "s/[\/]\{2,\}/\//g" | sed "s/\/$//g"`"
+ 
+     #check bemountedpoint or mountpoint is already mounted
+-    if [ -n "` cat /proc/mounts | grep " $mountCheckPath " | grep $bemountedpoint`" ];then
++    if [ -n "`cat /proc/mounts | grep " $mountCheckPath " | grep $bemountedpoint`" ];then
+         g_LOG_Info "$mountCheckPath has been mounted"
+         return 1
+     fi
+@@ -349,16 +349,16 @@ function parseUrl()
+         TMP_PARAMS=`echo ${serverUrl} | awk -F "?" '{print $2}'`
+         if [ -n "${TMP_PARAMS}" ]; then
+             tempPattern=`echo ${TMP_PARAMS} | awk -F "@" '{print $1}'`
+-            if echo "${tempPattern} | grep -q "^[u|U]=.*$"; then
++            if echo "${tempPattern}" | grep -q "^[u|U]=.*$"; then
+                 userName=`echo ${tempPattern} | awk -F "=" '{print $2}'`
+-            elif echo "${tempPattern} | grep -q "^[p|P]=.*$"; then
++            elif echo "${tempPattern}" | grep -q "^[p|P]=.*$"; then
+                 password=`echo ${tempPattern} | awk -F "=" '{print $2}'`
+             fi
+ 
+             tempPattern=`echo ${TMP_PARAMS} | awk -F "@" '{print $2}'`
+-            if echo "${tempPattern} | grep -q "^[u|U]=.*$"; then
++            if echo "${tempPattern}" | grep -q "^[u|U]=.*$"; then
+                 userName=`echo ${tempPattern} | awk -F "=" '{print $2}'`
+-            elif echo "${tempPattern} | grep -q "^[p|P]=.*$"; then
++            elif echo "${tempPattern}" | grep -q "^[p|P]=.*$"; then
+                 password=`echo ${tempPattern} | awk -F "=" '{print $2}'`
+             fi
+ 
+-- 
+2.27.0
+

0005-support-use-20-escape-characters-in-url.patch

@@ -0,0 +1,49 @@
+From d08e3843904fee9bfb955a928a55a2f08b8f054a Mon Sep 17 00:00:00 2001
+From: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+Date: Tue, 15 Aug 2023 14:48:50 +0800
+Subject: [PATCH] support use %20 escape characters in url
+
+Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+---
+ usr/Euler/project/install/setupOS.sh | 4 ++--
+ usr/Euler/project/load/load.sh       | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/usr/Euler/project/install/setupOS.sh b/usr/Euler/project/install/setupOS.sh
+index f1040c4..f8a6f79 100644
+--- a/usr/Euler/project/install/setupOS.sh
++++ b/usr/Euler/project/install/setupOS.sh
+@@ -189,7 +189,7 @@ function SetupOS_Decompr()
+ 
+     #sha256sum check
+     if [ ! -z "$LOCAL_SOURCE_PATH" -a ! -z "$SI_OSTARNAME" -a -f "$LOCAL_SOURCE_PATH/$SI_OSTARNAME.sha256" ]; then
+-        pushd $LOCAL_SOURCE_PATH >> $OTHER_TTY 2>&1
++        pushd "$LOCAL_SOURCE_PATH" >> $OTHER_TTY 2>&1
+         sha256sum -c "$SI_OSTARNAME.sha256" >> $OTHER_TTY 2>&1
+         if [ $? -eq 0 ]; then
+             g_LOG_Info "sha256sum success."
+@@ -211,7 +211,7 @@ function SetupOS_Decompr()
+         return 1
+     fi
+ 
+-    tar -xzf $LOCAL_SOURCE_PATH/$SI_OSTARNAME -C $LOCAL_UNCOMPRESS_PATH >> $OTHER_TTY 2>&1
++    tar -xzf "$LOCAL_SOURCE_PATH/$SI_OSTARNAME" -C "$LOCAL_UNCOMPRESS_PATH" >> $OTHER_TTY 2>&1
+     if [ $? -ne 0 ]; then
+         g_LOG_Error "uncompressed the $LOCAL_SOURCE_PATH/$SI_OSTARNAME failed."
+           return 1
+diff --git a/usr/Euler/project/load/load.sh b/usr/Euler/project/load/load.sh
+index 2f0a5d8..176bb1c 100644
+--- a/usr/Euler/project/load/load.sh
++++ b/usr/Euler/project/load/load.sh
+@@ -109,7 +109,7 @@ function g_Load_Os
+ 
+         if echo $tran_protocol | grep -q -E "^[fF][tT][pP]$|^[hH][tT][tT][pP]$"; then 
+    	     if [ "x$FT_SERVER_SOURCE_PATH" != "x" ]; then
+-                 LOCAL_SOURCE_PATH="$LOCAL_SOURCE_PATH/$FT_SERVER_SOURCE_PATH/repo"
++                 LOCAL_SOURCE_PATH="$LOCAL_SOURCE_PATH/${FT_SERVER_SOURCE_PATH//%20/ }/repo"
+              else
+ 		 LOCAL_SOURCE_PATH="$LOCAL_SOURCE_PATH/repo"
+              fi
+-- 
+2.27.0
+

0006-mount-sysfs-and-proc-with-nodev-and-noexec-mode.patch

@@ -0,0 +1,31 @@
+From c272c36c9455f92200d42de951065c1cf8205547 Mon Sep 17 00:00:00 2001
+From: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+Date: Thu, 12 Oct 2023 21:31:42 +0800
+Subject: [PATCH] mount sysfs and proc with nodev and noexec mode
+
+Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+---
+ usr/Euler/project/install/setupOS.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/usr/Euler/project/install/setupOS.sh b/usr/Euler/project/install/setupOS.sh
+index 807d01f..af4777f 100644
+--- a/usr/Euler/project/install/setupOS.sh
++++ b/usr/Euler/project/install/setupOS.sh
+@@ -294,10 +294,10 @@ function SetupOS_CpFstab()
+         fi
+ 
+         #modify fstab，add "proc，sysfs，debugfs，usbfs，devpts"
+-        echo "sysfs                /sys                 sysfs      noauto                0 0" >> ${LOCAL_DISK_PATH}${SI_FSTAB}
+-        echo "proc                 /proc                proc       defaults              0 0" >> ${LOCAL_DISK_PATH}${SI_FSTAB}
++        echo "sysfs                /sys                 sysfs      nosuid,nodev,noexec,noauto                0 0" >> ${LOCAL_DISK_PATH}${SI_FSTAB}
++        echo "proc                 /proc                proc       nosuid,nodev,noexec              0 0" >> ${LOCAL_DISK_PATH}${SI_FSTAB}
+         echo "usbfs                /proc/bus/usb        usbfs      noauto                0 0" >> ${LOCAL_DISK_PATH}${SI_FSTAB}
+-        echo "devpts               /dev/pts             devpts     mode=0620,gid=5       0 0" >> ${LOCAL_DISK_PATH}${SI_FSTAB}
++        echo "devpts               /dev/pts             devpts     nosuid,noexec,mode=0620,gid=5       0 0" >> ${LOCAL_DISK_PATH}${SI_FSTAB}
+ 
+         g_LOG_Info "copy $FSTAB_FILE success."
+ 
+-- 
+2.27.0
+

install-scripts.spec

@@ -3,11 +3,16 @@ Summary:        scripts for system installation
 Group:          Applications/System
 License:        MulanPSL-2.0
 Version:        1.2
-Release:        5
+Release:        10
 SOURCE0:        %{name}-%{version}.tar.gz
 
 Patch0001: 0001-add-support-for-nvme-disk.patch
 Patch0002: 0002-support-mbsc.patch
+Patch0003: 0003-remove-the-executable-permission-of-non-root-users-f.patch
+Patch0004: 0004-fix-missing-quotation-in-filetransfer.sh.patch
+Patch0005: 0005-support-use-20-escape-characters-in-url.patch
+Patch0006: 0006-mount-sysfs-and-proc-with-nodev-and-noexec-mode.patch
+
 Requires:       kernel
 BuildRequires:  dos2unix coreutils findutils
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
@@ -25,10 +30,6 @@ mkdir -m 750 -p $RPM_BUILD_ROOT/usr/Euler/
 
 cp -a usr/Euler/project $RPM_BUILD_ROOT/usr/Euler/
 
-find $RPM_BUILD_ROOT/usr/Euler/ -type d | xargs chmod 750
-
-find $RPM_BUILD_ROOT/usr/Euler/ -type f | xargs chmod 500
-
 mkdir -p $RPM_BUILD_ROOT/usr/lib/systemd/system/
 mkdir -p $RPM_BUILD_ROOT/usr/lib/systemd/system/initrd-euler.target.wants/
 mkdir -p $RPM_BUILD_ROOT/usr/lib/systemd/system/emergency.target.wants/
@@ -37,25 +38,6 @@ mkdir -p $RPM_BUILD_ROOT/etc/sysctl.d/
 cp -a data/* $RPM_BUILD_ROOT/usr/lib/systemd/system/
 cp -a config/01-euler-printk.conf $RPM_BUILD_ROOT/etc/sysctl.d/
 
-%files
-%defattr(0500,root,root)
-%dir /usr/Euler
-%dir /usr/Euler/project
-%dir /usr/Euler/project/disk
-%dir /usr/Euler/project/init
-%dir /usr/Euler/project/install
-%dir /usr/Euler/project/load
-%dir /usr/Euler/project/log
-%dir /usr/Euler/project/util
-/usr/Euler/project/disk/*
-/usr/Euler/project/init/*
-/usr/Euler/project/install/*
-/usr/Euler/project/load/*
-/usr/Euler/project/log/*
-/usr/Euler/project/util/*
-
-%attr(0640,root,root) /usr/lib/systemd/system/*
-%attr(0640,root,root) /etc/sysctl.d/01-euler-printk.conf
 
 %post
 ln -s /sbin/init /init
@@ -101,7 +83,57 @@ rm -rf $RPM_BUILD_ROOT/*
 rm -rf %{_tmppath}/%{name}-%{version}
 rm -rf $RPM_BUILD_DIR/%{name}-%{version}
 
+%files
+%defattr(0500,root,root,0500)
+%dir /usr/Euler
+%dir /usr/Euler/project
+%dir /usr/Euler/project/disk
+%dir /usr/Euler/project/init
+%dir /usr/Euler/project/install
+%dir /usr/Euler/project/load
+%dir /usr/Euler/project/log
+%dir /usr/Euler/project/util
+/usr/Euler/project/disk/*
+/usr/Euler/project/init/*
+/usr/Euler/project/install/*
+/usr/Euler/project/load/*
+/usr/Euler/project/log/*
+/usr/Euler/project/util/*
+
+%attr(0640,root,root) /usr/lib/systemd/system/*
+%attr(0640,root,root) /etc/sysctl.d/01-euler-printk.conf
+
 %changelog
+* Thu Oct 12 2023 zhangqiumiao <zhangqiumiao1@huawei.com> - 1.2-10
+- Type:requirement
+- CVE:NA
+- SUG:NA
+- DESC:mount sysfs and proc with nodev and noexec mode
+
+* Tue Aug 15 2023 zhangqiumiao <zhangqiumiao1@huawei.com> - 1.2-9
+- Type:requirement
+- CVE:NA
+- SUG:NA
+- DESC:support use %20 escape characters in url
+
+* Fri May 26 2023 zhangqiumiao <zhangqiumiao1@huawei.com> - 1.2-8
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:fix missing quotation in filetransfer.sh
+
+* Fri May 5 2023 fengtao <fengtao40@huawei.com> - 1.2-7
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:modify directory permission
+
+* Fri Feb 3 2023 zhangqiumiao <zhangqiumiao1@huawei.com> - 1.2-6
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:fix missing Patch0003 in spec file
+
 * Mon Dec 19 2022 zhangqiumiao <zhangqiumiao1@huawei.com> - 1.2-5
 - Type:bugfix
 - CVE:NA