From 9616efdbb807c06ba9be6bea3087ef6e39f75c83 Mon Sep 17 00:00:00 2001
From: Eric Hameleers <alien@slackware.com>
Date: Wed, 20 Nov 2019 23:21:44 +0100
Subject: Remove '--no-absolute-filenames' from cpio invocations

Since cpio 2.13, this option strips '/' and '../' from symbolic and
hard links during extraction of a cpio archive like our initramfs.
This is implemented as a fix for CVE-2015-1197 but breaks the initrd.
And leaving out this option does not have the adverse effect
I always thought it would have... archive extraction is still done
into the current directory and not in the filesystem root.
---
 upslak.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'upslak.sh')

diff --git a/upslak.sh b/upslak.sh
index c1559df..4af5ae5 100644
--- a/upslak.sh
+++ b/upslak.sh
@@ -411,7 +411,7 @@ extract_initrd() {
 
   cd ${IMGDIR}
     uncompressfs ${IMGFILE} \
-      | cpio -i -d -H newc --no-absolute-filenames
+      | cpio -i -d -m -H newc
 } # End of extract_initrd()
     
 # Modify the extracted initrd and re-pack it:
-- 
cgit v1.2.3