Hardened Linux From Scratch - Version SVN-20070501

Chapter 6. Installing Basic System Software

6.18. Coreutils-6.7

The Coreutils package contains utilities for showing and setting the basic system characteristics.

6.18.1. Installation of Coreutils

A known issue with the uname program from this package is that the -p switch always returns unknown. The following patch fixes this behavior for i386 architectures: 

patch -Np1 -i ../coreutils-6.7-uname_PIC-1.patch

Now prepare Coreutils for compilation: 

./configure --prefix=/usr

Compile the package: 

make

First, run the tests that are meant to be run as user root: 

make NON_ROOT_USERNAME=nobody check-root

The “append-only” test uses the chattr program and only works on ext2 and ext3 filesystems. If your HLFS partition is formated with another filesystem, such as reiserfs, then this test will fail.

Then run the remainder of the tests as the nobody user: 

src/su nobody -s /bin/sh -c "make RUN_EXPENSIVE_TESTS=yes check"

This package installs some programs we may not want, and programs we do want in the wrong places. Install Coreutils to a temporary directory so the files can be manipulated before they are installed: 

make DESTDIR=$(pwd)/DESTDIR install

If you choose to install the Coreutils versions of uptime, su, or kill, you will have opportunities later to not install conflicting versions from other packages.

The uptime program provided by the Section 6.52, “Procps-3.2.7” package has about 10 times less code than the uptime program provided Coreutils, according to the size utility, and they both provide identical functionality. Most users and distributions favor the least bloated version of programs which have identical features. Remove this uptime with the following commands: 

rm -v DESTDIR/usr/bin/uptime \
    DESTDIR/usr/share/man/man1/uptime.1

The su program provided by the Section 6.54, “Shadow-4.0.18.1” package has more features than the version provided by Coreutils, such as Linux-PAM support. Most users and distributions favor the su program from the Section 6.54, “Shadow-4.0.18.1” package because of the added features, and it is more widely used. There is a discussion of the differences between the two versions here: http://www.diy-linux.org/pipermail/diy-linux-dev/2005-August/000610.html. Remove this su with the following commands: 

rm -v DESTDIR/usr/bin/su \
    DESTDIR/usr/share/man/man1/su.1

The kill program provided by the Section 6.52, “Procps-3.2.7” package has more options than the one provided by Coreutils, and is favored by many users and distributions. However, some other distributions believe this Coreutils version of kill is written more cleanly. Whether you use it or not is up to you. FIXME: -insert differences of the two versions here-. Remove it with the following commands: 

rm -v DESTDIR/usr/bin/kill \
    DESTDIR/usr/share/man/man1/kill.1

The true program provided by Coreutils provides --help and --version options, and has the overhead of the C library. The true program's sole purpose is to return 0, and nothing else. Because this program is often used for authentication and security sensitive tasks it is more secure to use a version written in assembly language. A true program written in assembly language will not only be smaller, but will use far fewer syscalls than a C language version. The following program is written in i386 assembly, and will only work on i386 (386, 486, and Pentium) hardware. Replace the Coreutils true with an assembly version with the following commands (we can keep the manual page): 

cat > src/true.S << "EOF"
/* Public Domain - i386 true.S */
.global _start
_start:
movl    $0,%ebx
movl    $1,%eax
int     $0x80
EOF

rm -v DESTDIR/usr/bin/true
gcc -nostdlib src/true.S -o DESTDIR/usr/bin/true

The false program provided by Coreutils has the same issues as the true program, but is moreso depended on for authentication and security tasks. Replace the Coreutils false program with an i386 assembly language version with the following commands: 

cat > src/false.S << "EOF"
/* Public Domain - i386 false.S */
.global _start
_start:
movl    $1,%ebx
movl    $1,%eax
int     $0x80
EOF

rm -v DESTDIR/usr/bin/false
gcc -nostdlib src/false.S -o DESTDIR/usr/bin/false

Move programs to the locations specified by the FHS: 

install -vd DESTDIR/bin
mv -v DESTDIR/usr/bin/{cat,chgrp,chmod,chown,cp,date,dd,df,echo} DESTDIR/bin
mv -v DESTDIR/usr/bin/{false,hostname,ln,ls,mkdir,mknod,mv,pwd,rm} DESTDIR/bin
mv -v DESTDIR/usr/bin/{rmdir,stty,sync,true,uname} DESTDIR/bin
install -vd DESTDIR/usr/sbin
mv -v DESTDIR/usr/bin/chroot DESTDIR/usr/sbin

Some of the scripts in the LFS-Bootscripts package depend on head, sleep, and nice. As /usr may not be available during the early stages of booting, those binaries need to be on the root partition: 

mv -v DESTDIR/usr/bin/{head,sleep,nice} DESTDIR/bin

Note that the Coreutils info page has not been edited to respect any of the programs you may have removed or replaced. You may want to modify it yourself.

Now copy the files to the system: 

cp -va DESTDIR/* /

kill, true, false, and many others, are bash shell builtins. To use the ones we just installed the full path must be given.

6.18.2. Contents of Coreutils

Installed programs: basename, cat, chgrp, chmod, chown, chroot, cksum, comm, cp, csplit, cut, date, dd, df, dir, dircolors, dirname, du, echo, env, expand, expr, factor, false, fmt, fold, groups, head, hostid, hostname, id, install, join, link, ln, logname, ls, md5sum, mkdir, mkfifo, mknod, mv, nice, nl, nohup, od, paste, pathchk, pinky, pr, printenv, printf, ptx, pwd, readlink, rm, rmdir, seq, sha1sum, shred, sleep, sort, split, stat, stty, sum, sync, tac, tail, tee, test, touch, tr, true, tsort, tty, uname, unexpand, uniq, unlink, users, vdir, wc, who, whoami, and yes

Short Descriptions

basename

Strips any path and a given suffix from a file name

cat

Concatenates files to standard output

chgrp

Changes the group ownership of files and directories

chmod

Changes the permissions of each file to the given mode; the mode can be either a symbolic representation of the changes to make or an octal number representing the new permissions

chown

Changes the user and/or group ownership of files and directories

chroot

Runs a command with the specified directory as the / directory

cksum

Prints the Cyclic Redundancy Check (CRC) checksum and the byte counts of each specified file

comm

Compares two sorted files, outputting in three columns the lines that are unique and the lines that are common

cp

Copies files

csplit

Splits a given file into several new files, separating them according to given patterns or line numbers and outputting the byte count of each new file

cut

Prints sections of lines, selecting the parts according to given fields or positions

date

Displays the current time in the given format, or sets the system date

dd

Copies a file using the given block size and count, while optionally performing conversions on it

df

Reports the amount of disk space available (and used) on all mounted file systems, or only on the file systems holding the selected files

dir

Lists the contents of each given directory (the same as the ls command)

dircolors

Outputs commands to set the LS_COLOR environment variable to change the color scheme used by ls

dirname

Strips the non-directory suffix from a file name

du

Reports the amount of disk space used by the current directory, by each of the given directories (including all subdirectories) or by each of the given files

echo

Displays the given strings

env

Runs a command in a modified environment

expand

Converts tabs to spaces

expr

Evaluates expressions

factor

Prints the prime factors of all specified integer numbers

false

Does nothing, unsuccessfully; it always exits with a status code indicating failure

fmt

Reformats the paragraphs in the given files

fold

Wraps the lines in the given files

groups

Reports a user's group memberships

head

Prints the first ten lines (or the given number of lines) of each given file

hostid

Reports the numeric identifier (in hexadecimal) of the host

hostname

Reports or sets the name of the host

id

Reports the effective user ID, group ID, and group memberships of the current user or specified user

install

Copies files while setting their permission modes and, if possible, their owner and group

join

Joins the lines that have identical join fields from two separate files

link

Creates a hard link with the given name to a file

ln

Makes hard links or soft (symbolic) links between files

logname

Reports the current user's login name

ls

Lists the contents of each given directory

md5sum

Reports or checks Message Digest 5 (MD5) checksums

mkdir

Creates directories with the given names

mkfifo

Creates First-In, First-Outs (FIFOs), a “named pipe” in UNIX parlance, with the given names

mknod

Creates device nodes with the given names; a device node is a character special file, a block special file, or a FIFO

mv

Moves or renames files or directories

nice

Runs a program with modified scheduling priority

nl

Numbers the lines from the given files

nohup

Runs a command immune to hangups, with its output redirected to a log file

od

Dumps files in octal and other formats

paste

Merges the given files, joining sequentially corresponding lines side by side, separated by tab characters

pathchk

Checks if file names are valid or portable

pinky

Is a lightweight finger client; it reports some information about the given users

pr

Paginates and columnates files for printing

printenv

Prints the environment

printf

Prints the given arguments according to the given format, much like the C printf function

ptx

Produces a permuted index from the contents of the given files, with each keyword in its context

pwd

Reports the name of the current working directory

readlink

Reports the value of the given symbolic link

rm

Removes files or directories

rmdir

Removes directories if they are empty

seq

Prints a sequence of numbers within a given range and with a given increment

sha1sum

Prints or checks 160-bit Secure Hash Algorithm 1 (SHA1) checksums

shred

Overwrites the given files repeatedly with complex patterns, making it difficult to recover the data

sleep

Pauses for the given amount of time

sort

Sorts the lines from the given files

split

Splits the given file into pieces, by size or by number of lines

stat

Displays file or filesystem status

stty

Sets or reports terminal line settings

sum

Prints checksum and block counts for each given file

sync

Flushes file system buffers; it forces changed blocks to disk and updates the super block

tac

Concatenates the given files in reverse

tail

Prints the last ten lines (or the given number of lines) of each given file

tee

Reads from standard input while writing both to standard output and to the given files

test

Compares values and checks file types

touch

Changes file timestamps, setting the access and modification times of the given files to the current time; files that do not exist are created with zero length

tr

Translates, squeezes, and deletes the given characters from standard input

true

Does nothing, successfully; it always exits with a status code indicating success

tsort

Performs a topological sort; it writes a completely ordered list according to the partial ordering in a given file

tty

Reports the file name of the terminal connected to standard input

uname

Reports system information

unexpand

Converts spaces to tabs

uniq

Discards all but one of successive identical lines

unlink

Removes the given file

users

Reports the names of the users currently logged on

vdir

Is the same as ls -l

wc

Reports the number of lines, words, and bytes for each given file, as well as a total line when more than one file is given

who

Reports who is logged on

whoami

Reports the user name associated with the current effective user ID

yes

Repeatedly outputs “y” or a given string until killed