Pi-Hole

Recent Commits

• darkexplosiveqwx(17 Oct 26)

  Core v6.5 (#6719)

• darkexplosiveqwx(17 Oct 26)

  Silence ShellCheck SC2024 for local adlist read in gravity (#6722)

• Adam Warner(17 Oct 26)

  Silence ShellCheck SC2024 for local adlist read in gravity The output buffer belongs to the calling user, so only the read is meant to run as the pihole user. Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Adam Warner <[email protected]>

• Adam Warner(17 Oct 26)

  Merge commit from fork Read local adlists as the user whose access was checked

• darkexplosiveqwx(17 Oct 26)

  Make test_symlink_safety.bats executable (#6721)

• Adam Warner(17 Oct 26)

  Add diffutils to RPM dependencies and CentOS test images installLogrotate calls diff, which is not present on minimal CentOS images, so the logrotate upgrade was skipped. Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Adam Warner <[email protected]>

• Adam Warner(17 Oct 26)

  Fix gravity test message for non-root file read check Gravity now runs as the pihole user at this point, so it reports "current user 'pihole'" rather than the root-path message. Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Adam Warner <[email protected]>

• Adam Warner(17 Oct 26)

  Make test_symlink_safety.bats executable The smoke-tests workflow requires all .bats files to be executable. Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Adam Warner <[email protected]>

• darkexplosiveqwx(17 Oct 26)

  save/store listsCacheDir in same directory as gravity.db (#6489)

• Adam Warner(17 Oct 26)

  Merge commit from fork Make `/opt/pihole` read-only for the FTL service

• DL6ER(19 Sept 26)

  Keep `CAP_CHOWN` in the ambient set of the FTL service The installer puts no file capabilities on `pihole-FTL`, so on a systemd installation the ambient set is the only place FTL gets `CAP_CHOWN` from. Without it, FTL cannot take over files root created in `/etc/pihole` and cannot set the RTC. The inheritance this was meant to stop is closed in FTL itself: v6.7.1 removes `CAP_CHOWN` from its inheritable and ambient sets before it starts any thread and keeps it across its own restart. The read-only `/opt/pihole` stays. Signed-off-by: DL6ER <[email protected]>

• DL6ER(16 Aug 26)

  Stop granting CAP_CHOWN to everything pihole-FTL executes The unit granted CAP_CHOWN through AmbientCapabilities. The ambient set is inherited across execve(), so every process FTL starts - a DHCP script, anything a Lua page spawns - could take ownership of files it does not own, which is a short step from root. Any code execution in the FTL service context was therefore a local privilege escalation. FTL receives CAP_CHOWN from the file capabilities on its binary (setcap ...+eip) for the file ownership changes it makes at startup and for the RTC device, and it drops the capability once startup is done. A child that is not pihole-FTL does not inherit file capabilities, so removing CAP_CHOWN from the ambient set closes the inheritance without affecting FTL. Also mark /opt/pihole read-only for the service: ProtectSystem=full leaves it writable, and it holds the root-run prestart script. FTL only reads and executes from there. Signed-off-by: DL6ER <[email protected]>

• Dominik(17 Oct 26)

  Flush the last 24 hours of queries through the FTL API (#6716)

• Adam Warner(17 Oct 26)

  Merge commit from fork fix: don't let root write the version file into pihole-owned /etc/pihole

• Adam Warner(17 Oct 26)

  Merge commit from fork Never write to config-supplied paths as root

• Adam Warner(17 Oct 26)

  Merge commit from fork Only accept a PID naming a running `pihole-FTL`

• Adam Warner(17 Oct 26)

  Move existing listsCache when gravity.db lives outside /etc/pihole With files.gravity pointing outside /etc/pihole, listsCacheDir now follows gravity.db. migrate_to_listsCache_dir() only handled the pre-v6 loose list.* files, so an existing /etc/pihole/listsCache was left behind and all lists were re-downloaded, losing their ETag/sha1 state. Move an existing ${piholeDir}/listsCache into ${listsCacheDir} when the two differ and remove the old (then empty) directory. The .sha1 files contain absolute paths, so rewrite ${piholeDir}/listsCache/ to ${listsCacheDir}/ for this case. The pre-v6 migration keeps its own sed so the two rewrites cannot interfere with each other. Co-authored-by: DL6ER <[email protected]> Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Adam Warner <[email protected]>

• Adam Warner(17 Oct 26)

  Use parameter expansion and path canonicalization to safely parse local file URIs (#6688)

• Adam Warner(17 Oct 26)

  Pass the adlist source URL to FTL's `parseList` (#6706)

• DL6ER(17 Oct 26)

  Extract the v6.4.3 logrotate reference with `awk` in the test BusyBox `sed` keeps the range start line with `{//!p}`, so the Alpine test wrote a broken reference file. Signed-off-by: DL6ER <[email protected]>

• DL6ER(11 Oct 26)

  Test `getFTLPID()` and the logrotate migration Signed-off-by: DL6ER <[email protected]>

• DL6ER(11 Oct 26)

  Only accept a PID naming a running `pihole-FTL` `/run/pihole-FTL.pid` is owned by the `pihole` user, but root reads it. `getFTLPID()` only rejected values starting with a non-digit, so `1+a[$(cmd)]` passed and was executed by the arithmetic `[[ ... -eq ... ]]` checks in `pihole`. The logrotate `postrotate` sent `kill -USR2` to whatever the file contained, including `-1`. 1. `getFTLPID()` accepts only a plain number whose `/proc/<pid>/comm` is `pihole-FTL`. 2. The logrotate `postrotate` uses `getFTLPID()`. The installer swaps this line in existing files, which are otherwise never replaced. Signed-off-by: DL6ER <[email protected]>

• DL6ER(24 Sept 26)

  Pass the adlist source URL to FTL's `parseList` `parseList` currently receives the cached file, the target database and the adlist ID. This adds the originating source URL as a final, quoted argument so FTL can take the source into account when parsing a list. This relies on the matching FTL change that reads the extra argument, so it should land together with that FTL bump. Signed-off-by: DL6ER <[email protected]>

• DL6ER(16 Oct 26)

  Read local adlists as the user whose access was checked The read check for `file://` lists resolves the path through the kernel as the `pihole` user, while curl normalizes the URL path itself before opening it, possibly as root. Both can end up at different files. Read local lists with `cat` as the same user the check ran as instead. Signed-off-by: DL6ER <[email protected]>

• Michael Woolweaver(17 Oct 26)

  Fix parsing of local file URIs in gravity Strip the "file:" scheme and an empty authority using parameter expansion, so that both file:///path and file:/path resolve to /path. The previous cut-based parsing turned file:/path into a relative path. Update the /etc/shadow regression test to expect the permission error now that file:/./etc/shadow resolves to the absolute /etc/shadow. Co-authored-by: DL6ER <[email protected]> Signed-off-by: Adam Warner <[email protected]>

• Adam Warner(16 Oct 26)

  Improve gravity.db schema (#6575)

• DL6ER(16 Oct 26)

  Merge branch 'development' into tweak/improve_gravity_db Signed-off-by: DL6ER <[email protected]>

• Dominik(16 Oct 26)

  Fix URL parsing in gravity.sh (#6689)

• Adam Warner(09 Oct 26)

  test: prestart must not follow symlinks at the version and lease file paths Regression test for the original GHSA-xch2-4qxw-g5vj fix: with root-only files planted behind symlinks at /etc/pihole/versions and /etc/pihole/dhcp.leases, prestart must leave them untouched. Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Adam Warner <[email protected]>

• Adam Warner(09 Oct 26)

  fix: only trust git repositories the pihole user cannot modify mark_repos_safe() adds the Core and Web repositories to git's system-wide safe.directory list so that the (now unprivileged) updatechecker can read local versions. The Web path comes from pihole.toml, which the pihole user can edit. Pointing it at a directory that user controls and swapping in a crafted repository would make root run git in a repository it was told to trust, e.g. during `pihole -up`, which is a path to running code as root. Only trust a path that - resolves, without symlinks, to a real directory, and - is root-owned together with its .git and not world-writable, i.e. cannot be modified by the pihole user. The resolved path is what gets recorded. Also make sure the system git config is world-readable. git silently ignores one the pihole user cannot read, which is exactly what happens when it is created under a restrictive umask (found by the fresh install test, which installs with umask 0027). Tests cover each rule, idempotency and the umask case. Reported-by: Keith Linneman (LinnemanLabs) Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Adam Warner <[email protected]>