aboutsummaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* spdx: The BSD-2-Clause-NetBSD identifier is obsolete, drop -NetBSDWarner Losh2023-05-1232-32/+32
| | | | | | | | | The SPDX folks have obsoleted the BSD-2-Clause-NetBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix
* spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDWarner Losh2023-05-12722-722/+722
| | | | | | | | | The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix
* libfido2: specify OpenSSL 1.1 APIEd Maste2023-05-091-0/+1
| | | | | | | | | | | | OPENSSL_API_COMPAT can be used to specify the OpenSSL API version in use for the purpose of hiding deprecated interfaces and enabling the appropriate deprecation notices. This change is a NFC while we're still using OpenSSL 1.1.1 but will avoid deprecation warnings upon the switch to OpenSSL 3.0. A future libfido2 update may switch to use OpenSSL 3.0 APIs. Sponsored by: The FreeBSD Foundation
* acl(3): improve discoverability of acl_get_perm_np(3)Kyle Evans2023-05-092-2/+8
| | | | | | | | - Mention it in acl(3) as an available function, xref - Mention it in acl_get_permset(3), as acl_get_perm_np(3) is a natural follow-up to acl_get_permset(3) Sponsored by: Klara, Inc.
* libc: document when the namespace was createdMariusz Zaborski2023-05-071-0/+1
| | | | | Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D39989
* libfido2: update to 1.10.0Ed Maste2023-05-051-1/+1
| | | | | | | | | | | | | | | | | Some highlights from NEWS: ** bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480. ** New API calls: - fido_dev_info_set; - fido_dev_io_handle; - fido_dev_new_with_info; - fido_dev_open_with_info. ** Documentation and reliability fixes. ** Support for TPM 2.0 attestation of COSE_ES256 credentials. Relnotes: Yes Sponsored by: The FreeBSD Foundation
* libfido2: update to 1.9.0Ed Maste2023-05-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Some highlights from NEWS: ** Added OpenSSL 3.0 compatibility. ** Removed OpenSSL 1.0 compatibility. ** Support for FIDO 2.1 "minPinLength" extension. ** Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation. ** Support for TPM 2.0 attestation. ** Support for device timeouts; see fido_dev_set_timeout(). ** New API calls: - es256_pk_from_EVP_PKEY; - fido_cred_attstmt_len; - fido_cred_attstmt_ptr; - fido_cred_pin_minlen; - fido_cred_set_attstmt; - fido_cred_set_pin_minlen; - fido_dev_set_pin_minlen_rpid; - fido_dev_set_timeout; - rs256_pk_from_EVP_PKEY. ** Reliability and portability fixes. ** Better handling of HID devices without identification strings; gh#381. Relnotes: Yes Sponsored by: The FreeBSD Foundation
* local.dirdeps.mk skip N_host_libs for non-FreeBSD hostSimon J. Gerraty2023-05-042-1/+1
| | | | | | | | | The N_host_libs dance only makes sense if host is FreeBSD. Even then, if MK_host_egacy is yes we need libmd libnetbsd does not need libutil when using libegacy Sponsored by: Juniper Networks, Inc.
* zfs: merge openzfs/zfs@d96e29576Martin Matuska2023-05-033-9/+9
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Notable upstream pull request merges: #11680 Add support for zpool user properties #14145 Storage device expansion "silently" fails on degraded vdev #14405 Create zap for root vdev #14659 Allow MMP to bypass waiting for other threads #14674 Miscellaneous FreBSD compilation bugfixes #14692 Fix some signedness issues in arc_evict() #14702 Fix typo in check_clones() #14715 module: small fixes for FreeBSD/aarch64 #14716 Trim needless zeroes from checksum events #14719 vdev: expose zfs_vdev_max_ms_shift as a module parameter #14722 Fix "Detach spare vdev in case if resilvering does not happen" #14723 freebsd clone range fixes #14728 Fix BLAKE3 aarch64 assembly for FreeBSD and macOS #14735 Fix in check_filesystem() #14739 Fix data corruption when cloning embedded blocks #14758 Fix VERIFY(!zil_replaying(zilog, tx)) panic #14761 Revert "ZFS_IOC_COUNT_FILLED does unnecessary txg_wait_synced()" #14774 FreeBSD .zfs fixups #14776 FreeBSD: make zfs_vfs_held() definition consistent with declaration #14779 powerpc64: Support ELFv2 asm on Big Endian #14788 FreeBSD: add missing vop_fplookup assignments #14789 PAM: support the authentication facility #14790 Revert "Fix data race between zil_commit() and zil_suspend()" #14795 Fix positive ABD size assertion in abd_verify() #14798 Mark TX_COMMIT transaction with TXG_NOTHROTTLE #14804 Correct ABD size for split block ZIOs #14806 Use correct block pointer in block cloning case. #14808 blake3: fix up bogus checksums in face of cpu migration Obtained from: OpenZFS OpenZFS commit: d96e29576c89e6e547cb82b477651d2b85ea0fed
| * powerpc64: Support ELFv2 asm on Big EndianJustin Hibbits2023-04-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | FreeBSD/powerpc64 is all ELFv2 since FreeBSD 13, even big endian. The existing sha256 and sha512 asm code assumes that BE is all ELFv1, and LE is ELFv2. Minor changes to add ELFv2 in the BE side gets this working correctly on FreeBSD with latest OpenZFS import. Reviewed-by: Tino Reichardt <milky-zfs@mcmilk.de> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Justin Hibbits <chmeeedalf@gmail.com> Closes #14779
| * Add loongarch64 supportHan Gao2023-04-251-1/+17
| | | | | | | | | | | | | | | | | | | | | | Add loongarch64 definitions & lua module setjmp asm LoongArch is a new RISC ISA, which is a bit like MIPS or RISC-V. Reviewed-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Han Gao <gaohan@uniontech.com> Signed-off-by: WANG Xuerui <xen0n@gentoo.org> Closes #13422
| * Add support for zpool user propertiesAllan Jude2023-04-213-64/+169
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usage: zpool set org.freebsd:comment="this is my pool" poolname Tests are based on zfs_set's user property tests. Also stop truncating property values at MAXNAMELEN, use ZFS_MAXPROPLEN. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Allan Jude <allan@klarasystems.com> Signed-off-by: Mateusz Piotrowski <mateusz.piotrowski@klarasystems.com> Sponsored-by: Beckhoff Automation GmbH & Co. KG. Sponsored-by: Klara Inc. Closes #11680
| * Create zap for root vdevrob-wing2023-04-203-8/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And add it to the AVZ, this is not backwards compatible with older pools due to an assertion in spa_sync() that verifies the number of ZAPs of all vdevs matches the number of ZAPs in the AVZ. Granted, the assertion only applies to #DEBUG builds - still, a feature flag is introduced to avoid the assertion, com.klarasystems:vdev_zaps_v2 Notably, this allows to get/set properties on the root vdev: % zpool set user:prop=value <pool> root-0 Before this commit, it was already possible to get/set properties on top-level vdevs with the syntax <type>-<vdev_id> (e.g. mirror-0): % zpool set user:prop=value <pool> mirror-0 This syntax also applies to the root vdev as it is is of type 'root' with a vdev_id of 0, root-0. The keyword 'root' as an alias for 'root-0'. The following tests have been added: - zpool get all properties from root vdev - zpool set a property on root vdev - verify root vdev ZAP is created Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Rob Wing <rob.wing@klarasystems.com> Sponsored-by: Seagate Technology Submitted-by: Klara, Inc. Closes #14405
| * libzfs: add v2 iterator interfacesRob N2023-04-107-61/+168
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | f6a0dac84 modified the zfs_iter_* functions to take a new "flags" parameter, and introduced a variety of flags to ask the kernel to limit the results in various ways, reducing the amount of work the caller needed to do to filter out things they didn't need. Unfortunately this change broke the ABI for existing clients (read: older versions of the `zfs` program), and was reverted 399b98198. dc95911d2 reintroduced the original patch, with the understanding that a backwards-compatible fix would be made before the 2.2 release branch was tagged. This commit is that fix. This introduces zfs_iter_*_v2 functions that have the new flags argument, and reverts the existing functions to not have the flags parameter, as they were before. The old functions are now reimplemented in terms of the new, with flags set to 0. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Wilson <george.wilson@delphix.com> Original-patch-by: George Wilson <george.wilson@delphix.com> Signed-off-by: Rob Norris <rob.norris@klarasystems.com> Sponsored-by: Klara, Inc. Closes #14597
| * Fix "Add colored output to zfs list"Tino Reichardt2023-04-052-1/+5
| | | | | | | | | | | | | | | | | | | | | | Running `zfs list -o avail rpool` resulted in a core dump. This commit will fix this. Run the needed overhead only, when `use_color()` is true. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Wilson <gwilson@delphix.com> Signed-off-by: Tino Reichardt <milky-zfs@mcmilk.de> Closes #14712
* | bsd.lib.mk: decouple lib*_pic.a from TOOLCHAIN build knobEd Maste2023-05-011-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | A user may use a tool chain from a package or just use an existing tool chain from a previous installation. There is no reason for this to disable the installation of lib${LIB}_pic.a. This also means we don't need to force MK_TOOLCHAIN=yes in lib/libc. This reverts part of commit c0f5aeb0329d71e6b02379133c0c9c0145c9afea. Reviewed by: jrtc27 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D39917
* | libc: Fix a documentation spelling mistakeTom Hukins2023-05-011-1/+1
| | | | | | | | Pull Request: https://github.com/freebsd/freebsd-src/pull/704
* | listen(2): improve administrator control over loggingEugene Grosbein2023-04-301-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented in listen.2 manual page, the kernel emits a LOG_DEBUG syslog message if a socket listen queue overflows. For some appliances, it may be desirable to change the priority to some higher value like LOG_INFO while keeping other debugging suppressed. OTOH there are cases when such overflows are normal and expected. Then it may be desirable to suppress overflow logging altogether, so that dmesg buffer is not flooded over long run. In addition to existing sysctl kern.ipc.sooverinterval, introduce new sysctl kern.ipc.sooverprio that defaults to 7 (LOG_DEBUG) to preserve current behavior. It may be changed to any value in a range of 0..7 for corresponding priority or to -1 to suppress logging. Document it in the listen.2 manual page. MFC after: 1 month
* | libifconfig: fix carp key configurationKristof Provost2023-04-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There were two issues with the carp key configuration in the new netlink code. The first is that userspace failed to actually pass the CARP_NL_KEY attribute to the kernel, so a key was never set. The second issue is that snl_attr_get_string() returns a pointer to the string inside the netlink message. It does not copy the string to the target buffer. That's somewhat inconvenient to work with in libifconfig where we have a static buffer for the key. Introduce snl_attr_copy_string() which can copy a string to a target buffer and uses the 'arg' parameter to pass the buffer size, so it doesn't accidentally exceed the available space. Reviewed by: melifaro Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D39874
* | libifconfig: fix incorrect carp outputKristof Provost2023-04-281-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If one interface has a carp address configured on it ifconfig would show this information on all interfaces. That's because the kernel does (as one would expect) not return any carp data for interface without carp configuration. However, this wound up not overwriting the data passed in by the caller, and leaving the (now stale) information in pace. As a result the caller thought carp was configured on the interface. Zero out the input structure before making the call to the kernel, so that we correctly return 0 if there is no carp configuration on the queried interface. Sponsored by: Rubicon Communications, LLC ("Netgate")
* | cap_net tests: Skip tests if there is no connectivityMark Johnston2023-04-271-43/+86
| | | | | | | | | | | | | | | | | | | | When testing cap_connect() and name/addr lookup functions, skip tests if we fail and the error is not ENOTCAPABLE. This makes the tests amenable to running in CI without Internet connectivity. Reviewed by: oshogbo MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D39242
* | tzcode: Clean up the ctime(3) manual page.Dag-Erling Smørgrav2023-04-261-102/+89
| | | | | | | | | | | | | | MFC after: 3 weeks Sponsored by: Klara, Inc. Reviewed by: pauamma_gundo.com Differential Revision: https://reviews.freebsd.org/D39714
* | Update tzcode to 2023c.Dag-Erling Smørgrav2023-04-261-0/+1
|\ \ | | | | | | | | | | | | | | | | | | MFC after: 3 weeks Sponsored by: Klara, Inc. Reviewed by: philip Differential Revision: https://reviews.freebsd.org/D39712
* | | pf: introduce ridentifier and labels to ether rulesChristian McDonald2023-04-262-1/+22
| | | | | | | | | | | | | | | | | | | | | | | | Make Ethernet rules more similar to the usual layer 3 rules by also allowing ridentifier and labels to be set on them. Reviewed by: kp Sponsored by: Rubicon Communications, LLC ("Netgate")
* | | We do not need readpassphrase from opensshSimon J. Gerraty2023-04-241-0/+2
| | | | | | | | | | | | | | | | | | When building tar for linux, just disable HAVE_READPASSPHRASE in config_freebsd.h and libarchive will provide for readpassphrase Otherwise the two conflict.
* | | Enable building tar for non-FreeBSD hostSimon J. Gerraty2023-04-241-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For DIRDEPS_BUILD we need Makefile.depend.options to force libegacy to be built on older FreeBSD and non-FreeBSD hosts. Add readpassphrase to libegacy to avoid the need for libbsd on Linux src.opts.mk disable TESTS for host if MK_host_egacy is yes Reviewed by: imp Sponsored by: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D39766
* | | libsmdb: Silence -Wstrict-prototype warnings.John Baldwin2023-04-241-1/+1
| | | | | | | | | | | | | | | | | | | | | Presumably upstream will fix this eventually. Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D39725
* | | zlib: Silence -Wstrict-prototype warnings.John Baldwin2023-04-241-1/+1
| | | | | | | | | | | | | | | | | | | | | Presumably upstream will fix this eventually. Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D39724
* | | Build host tools on non-FreeBSD host with DIRDEPS_BUILDSimon J. Gerraty2023-04-221-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add Makefile.depend.options to libnetbsd, mkimg and makefs to ensure libegacy is build if needed. targets/pseudo/stage/Makefile avoid the need for mtree the staging process creates target dirs as needed anyway. Reviewed by: stevek Sponsored by: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D39757
* | | libcbor: update to 0.10.2Ed Maste2023-04-211-1/+2
| | | | | | | | | | | | Sponsored by: The FreeBSD Foundation
* | | Remove a few more references to riscv64sf.John Baldwin2023-04-202-6/+1
| | | | | | | | | | | | Fixes: 1ca12bd927d7 Remove the riscv64sf architecture.
* | | Revert "libc: Implement bsort(3) a bitonic type of sorting algorithm."Hans Petter Selasky2023-04-206-505/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some points for the future: - libc is not the right place for sorting algorithms. Probably libutil is better suited for this purpose or a dedicated libsort. Should move all sorting algorithms away from libc eventually. - CheriBSD uses capabilities for memory access, and could benefit from a standard memswap() function. - Do something about qsort() in FreeBSD's libc like: - Mark it deprecated on FreeBSD, as a first step, due to missing limits on CPU time. - Audit the use of qsort() in the FreeBSD base system and consider swapping to other existing sorting algorithms. Discussed with: brooks@ Differential Revision: https://reviews.freebsd.org/D36493 This reverts commit a7469c9c0a504a5e6e9b89e148cd78df5e67ff7f. This reverts commit 7d65a450cdcc7cc743f2ecd114ba3428a21c0033. This reverts commit 8dcf3a82c54cb216df3213a013047907636a01da.
* | | Fix building host tools for hostSimon J. Gerraty2023-04-201-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several makefile depend on tools built for host. At least when using DIRDEPS_BUILD we can build these for the pseudo machine "host" to facilitate building on older host versions. Ideally we would build these tools in their own directories to avoid building more than needed. For now, setting an appropriate default for BTOOLSPATH will suffice Reviewed by: stevek Sponsored by: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D39708
* | | libz: Move NO_WDEPRECATED_NON_PROTOTYPE below include of bsd.lib.mk.John Baldwin2023-04-191-1/+2
| | | | | | | | | | | | Also add it to CWARNFLAGS rather than CFLAGS.
* | | libmilter: Silence -Wdeprecated-non-prototype warnings.John Baldwin2023-04-191-0/+2
| | | | | | | | | | | | | | | | | | Missed this one when tagging other sendmail libraries. Fixes: 525438ea7147 sendmail: Silence -Wdeprecated-non-prototype warnings.
* | | libc: Sorting is not needed when there are less than two elementsHans Petter Selasky2023-04-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If there are less than two elements avoid executing the first sorting loop. No functional change intended. Reviewed by: kib@ MFC after: 1 week Sponsored by: NVIDIA Networking Differential Revision: https://reviews.freebsd.org/D39691
* | | libc: Add missing object size check to qsort_s(3)Hans Petter Selasky2023-04-192-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When sorting, both the C11 standard (ISO/IEC 9899:2011, K.3.6.3.2) and the ISO/IEC JTC1 SC22 WG14 N1172 standard, does not define objects of zero size as undefined behaviour. However Microsoft's cpp-docs does. Add proper checks for this. Found while working on bsort(3). Reviewed by: kib@ and emaste@ MFC after: 1 week Sponsored by: NVIDIA Networking Differential Revision: https://reviews.freebsd.org/D39687
* | | bsort.3: Fix warnings as reported by mandoc -W warningHans Petter Selasky2023-04-191-6/+4
| | | | | | | | | | | | | | | | | | Reported by: Yuri <yuri@aetern.org> MFC after: 1 week Sponsored by: NVIDIA Networking
* | | libc: Implement bsort(3) a bitonic type of sorting algorithm.Hans Petter Selasky2023-04-196-1/+507
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bsort(3) algorithm works by swapping objects, similarly to qsort(3), and does not require any significant amount of additional memory. The bsort(3) algorithm doesn't suffer from the processing time issues known the plague the qsort(3) family of algorithms, and is bounded by a complexity of O(log2(N) * log2(N) * N), where N is the number of elements in the sorting array. The additional complexity compared to mergesort(3) is a fair tradeoff in situations where no memory may be allocated. The bsort(3) APIs are identical to those of qsort(3), allowing for easy drop-in and testing. The design of the bsort(3) algorithm allows for future parallell CPU execution when sorting arrays. The current version of the bsort(3) algorithm is single threaded. This is possible because fixed areas of the sorting data is compared at a time, and can easily be divided among different CPU's to sort large arrays faster. Reviewed by: gbe@, delphij@, pauamma_gundo.com (manpages) Sponsored by: NVIDIA Networking Differential Revision: https://reviews.freebsd.org/D36493
* | | Update/fix Makefile.depend for userlandSimon J. Gerraty2023-04-19115-169/+43
| | |
* | | umtx: allow to configure minimal timeout (in nanoseconds)Konstantin Belousov2023-04-183-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | PR: 270785 Reviewed by: markj, mav Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D39584
* | | sendmail: Silence -Wdeprecated-non-prototype warnings.John Baldwin2023-04-183-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | These will hopefully be fixed upstream eventually, but silence the warnings until then. Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D39518
* | | libveriexec: add function to check a label based on a pathSteve Kiernan2023-04-172-1/+31
| | | | | | | | | | | | | | | | | | | | | | | | veriexec_check_path_label() can be used to check if a specified path has a label associated with it that contains the what we want. Obtained from: Juniper Networks, Inc.
* | | veriexec: Additional functionality for MAC/veriexecSteve Kiernan2023-04-173-1/+195
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ensure veriexec opens the file before doing any read operations. When the MAC_VERIEXEC_CHECK_PATH_SYSCALL syscall is requested, veriexec needs to open the file before calling mac_veriexec_check_vp. This is to ensure any set up is done by the file system. Most file systems do not explicitly need an open, but some (e.g. virtfs) require initialization of access tokens (file identifiers, etc.) before doing any read or write operations. The evaluate_fingerprint() function needs to ensure it has an open file for reading in order to evaluate the fingerprint. The ideal solution is to have a hook after the VOP_OPEN call in vn_open. For now, we open the file for reading, envaluate the fingerprint, and close the file. While this leaves a potential hole that could possibly be taken advantage of by a dedicated aversary, this code path is not typically visited often in our use cases, as we primarily encounter verified mounts and not individual files. This should be considered a temporary workaround until discussions about the post-open hook have concluded and the hook becomes available. Add MAC_VERIEXEC_GET_PARAMS_PATH_SYSCALL and MAC_VERIEXEC_GET_PARAMS_PID_SYSCALL to mac_veriexec_syscall so we can fetch and check label contents in an unconstrained manner. Add a check for PRIV_VERIEXEC_CONTROL to do ioctl on /dev/veriexec Make it clear that trusted process cannot be debugged. Attempts to debug a trusted process already fail, but the failure path is very obscure. Add an explicit check for VERIEXEC_TRUSTED in mac_veriexec_proc_check_debug. We need mac_veriexec_priv_check to not block PRIV_KMEM_WRITE if mac_priv_gant() says it is ok. Reviewed by: sjg Obtained from: Juniper Networks, Inc.
* | | veriexec: Add SPDX-License-IdentifierStephen J. Kiernan2023-04-172-4/+4
| | |
* | | procctl: add state flags to PROC_REAP_GETPIDS reportsVal Packett2023-04-161-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For a process supervisor using the reaper API to track process subtrees, it is very useful to know the state of the processes on the list. Sponsored by: https://www.patreon.com/valpackett Reviewed by: kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D39585
* | | libsecureboot allow site.trust.mk to override settingsSimon J. Gerraty2023-04-151-1/+4
| | | | | | | | | | | | | | | The current content of local.trust.mk is mostly for example purposes.
* | | Fix DIRDEPS_BUILD for libgcc_ehSimon J. Gerraty2023-04-143-1/+18
| | |
* | | pkru.3: fix markupKonstantin Belousov2023-04-141-2/+2
| | | | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation MFC after: 3 days
* | | pf: backport OpenBSD syntax of "scrub" option for "match" and "pass" rulesKajetan Staszkiewicz2023-04-142-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce the OpenBSD syntax of "scrub" option for "match" and "pass" rules and the "set reassemble" flag. The patch is backward-compatible, pf.conf can be still written in FreeBSD-style. Obtained from: OpenBSD MFC after: never Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D38025
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-10 08:21:06 +0000