tree 9094ef88eec54c0a937af8c1715e90382db1f3b0
parent 8d42edc7231cddc308a49ee355aca79991f3cf51
author Yi-An Chen <chenyian@google.com> 1654488311 +0800
committer Chromeos LUCI <chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com> 1656013047 +0000

debugd: Pass absolute path to rma_fw_keeper

Original code verifies the absolute path of image_file and ro_db_dir.
But then provides the original image_file and ro_db_dir to rma_fw_keeper
as arguments. This allows for malicious filenames to be passed to the
script as long as it is a symlink which resolves to a valid firmware
file path.
BUG=chromium:1329946, b:234192237
TEST=FEATURES=test emerge-${BOARD} debugd
TEST=Verify the commands in crbug/1329946 used to exploit the bug no
     longer works.

Change-Id: I50f9e4b52e8744393e0d970ab9901de7f668b882
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform2/+/3691194
Tested-by: Yi-An Chen <chenyian@google.com>
Commit-Queue: Yi-An Chen <chenyian@google.com>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Aashay Shringarpure <aashay@google.com>
(cherry picked from commit c5f3d339d8f0a05d420e01ba41b339f43301a58d)
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform2/+/3717710
Commit-Queue: Aashay Shringarpure <aashay@google.com>