libjail: Guard against programmer error in jailparam_export()If the caller didn't use jailparam_import() to fetch the parametervalue, an attempt to export it will trigger a segfault. Make it a bi
libjail: Guard against programmer error in jailparam_export()If the caller didn't use jailparam_import() to fetch the parametervalue, an attempt to export it will trigger a segfault. Make it a biteasier to figure out what's happening in this situation.PR: 276809Reviewed by: jamieMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D43732(cherry picked from commit dfabf3efaa795e657f3858b7e2d0b11f8a51ecb5)
show more ...
Remove $FreeBSD$: two-line nroff patternRemove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/
Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Remove $FreeBSD$: one-line .c patternRemove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
Remove $FreeBSD$: two-line .h patternRemove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDThe SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catchup to that fact and revert to their recommended match of
spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDThe SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catchup to that fact and revert to their recommended match of BSD-2-Clause.Discussed with: pfgMFC After: 3 daysSponsored by: Netflix
Refer to a related manpageAdd reference to the lua jail man page.Reviewed by: imp, Mina GalicPull Request: https://github.com/freebsd/freebsd-src/pull/642
libjail: Handle an error from reallocarray() when trimming the buffer.There is no API guarantee that realloc() will not fail when the bufferis shrinking. Handle it by simply returning the untrimm
libjail: Handle an error from reallocarray() when trimming the buffer.There is no API guarantee that realloc() will not fail when the bufferis shrinking. Handle it by simply returning the untrimmed buffer.While this is unlikely to ever happen in practice, it seems worthhandling just to silence static analyzer warnings.PR: 243106Submitted by: Hans Christian Woithe <[email protected]>MFC after: 1 week
Update Makefile.depend filesUpdate a bunch of Makefile.depend files asa result of adding Makefile.depend.options filesReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDi
Update Makefile.depend filesUpdate a bunch of Makefile.depend files asa result of adding Makefile.depend.options filesReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D22494
pkgbase: Put a lot of binaries and lib in FreeBSD-runtimeAll of them are needed to be able to boot to single user and be ableto repair a existing FreeBSD installation so put them directly intoFre
pkgbase: Put a lot of binaries and lib in FreeBSD-runtimeAll of them are needed to be able to boot to single user and be ableto repair a existing FreeBSD installation so put them directly intoFreeBSD-runtime.Reviewed by: bapt, gjbDifferential Revision: https://reviews.freebsd.org/D21503
`libjail/jail.c' includes both <sys/param.h> and <sys/types.h>Latter is undesired when including <sys/param.h> according to style(9)Submitted by: Faraz VahediReviewed by: cemDifferential Revisi
`libjail/jail.c' includes both <sys/param.h> and <sys/types.h>Latter is undesired when including <sys/param.h> according to style(9)Submitted by: Faraz VahediReviewed by: cemDifferential Revision: https://reviews.freebsd.org/D20637
jail_getid(3): add special-case immediate return for jid 0As depicted in the comment: jid 0 always exists, but the lookup will fail asit does not appear in the kernel's alljails list being a speci
jail_getid(3): add special-case immediate return for jid 0As depicted in the comment: jid 0 always exists, but the lookup will fail asit does not appear in the kernel's alljails list being a special jail. Somecallers will expect/rely on this, and we have no reason to lie because itdoes always exist.Reported by: Stefan Hegnauer <stefan.hegnauer gmx ch>MFC after: soon (regression, breaks inspecting jail host bits, partialrevert)
jail_getid(3): validate jid string inputCurrently, if jail_getid(3) is passed in a numeric string, it assumes thatthis is a jid string and passes it back converted to an int without checkingthat
jail_getid(3): validate jid string inputCurrently, if jail_getid(3) is passed in a numeric string, it assumes thatthis is a jid string and passes it back converted to an int without checkingthat it's a valid/existing jid. This breaks consumers that might usejail_getid(3) to see if it can trivially grab a jid from a name if that namehappens to be numeric but not actually the name/jid of the jail. Instead ofreturning -1 for the jail not existing, it'll return the int version of theinput and the consumer will not fallback to trying other methods.Pass the numeric input to jail_get(2) as the jid for validation, rather thanthe name. This works well- the kernel enforces that jid=name if name isnumeric, so doing the safe thing and checking numeric input as a jid willstill DTRT based on the description of jail_getid.Reported by: Wes MaagReviewed by: jamie, Wes MaagMFC after: 3 daysDifferential Revision: https://reviews.freebsd.org/D20388
Rename fuse(4) to fusefs(4)This makes it more consistent with other filesystems, which all end in "fs",and more consistent with its mount helper, which is already named"mount_fusefs".Reviewed b
Rename fuse(4) to fusefs(4)This makes it more consistent with other filesystems, which all end in "fs",and more consistent with its mount helper, which is already named"mount_fusefs".Reviewed by: cem, rgrimesMFC after: 2 weeksSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D19649
libjail: fix handling of allow.mount.fusefs in jailparam_initfusefs is inconsistently named. The kernel module is named "fuse", but themount helper is named "mount_fusefs" and the jail(8) paramete
libjail: fix handling of allow.mount.fusefs in jailparam_initfusefs is inconsistently named. The kernel module is named "fuse", but themount helper is named "mount_fusefs" and the jail(8) parameter is named"allow.mount.fusefs". Special case it in libjail.Reviewed by: jamieMFC after: 2 weeksDifferential Revision: https://reviews.freebsd.org/D17929
Make it easier for filesystems to count themselves as jail-enabled,by doing most of the work in a new function prison_add_vfs in kern_jail.cNow a jail-enabled filesystem need only mark itself with
Make it easier for filesystems to count themselves as jail-enabled,by doing most of the work in a new function prison_add_vfs in kern_jail.cNow a jail-enabled filesystem need only mark itself with VFCF_JAIL, andthe rest is taken care of. This includes adding a jail parameter likeallow.mount.foofs, and a sysctl like security.jail.mount_foofs_allowed.Both of these used to be a static list of known filesystems, withpredefined permission bits.Reviewed by: kibDifferential Revision: D14681
If a jail parameter isn't found, try loading a related kernel module.
lib: further adoption of SPDX licensing ID tags.Mainly focus on files that use BSD 2-Clause license, however the tool Iwas using mis-identified many licenses so this was mostly a manual - errorpr
lib: further adoption of SPDX licensing ID tags.Mainly focus on files that use BSD 2-Clause license, however the tool Iwas using mis-identified many licenses so this was mostly a manual - errorprone - task.The Software Package Data Exchange (SPDX) group provides a specificationto make it easier for automated tools to detect and summarize well knownopensource licenses. We are gradually adopting the specification, notingthat the tags are considered only advisory and do not, in any way,superceed or replace the license texts.
DIRDEPS_BUILD: Update dependencies.Sponsored by: Dell EMC Isilon
libjail: make allocation in jailparam_all() somewhat more robust.Unsign some variables involved in allocation as they will never benegative anyways. Provide some bounds checking through reallocarr
libjail: make allocation in jailparam_all() somewhat more robust.Unsign some variables involved in allocation as they will never benegative anyways. Provide some bounds checking through reallocarray(3).This is all very unlikely to have any visible effect.Reviewed by: jamieMFC after: 3 weeks
Fix libjail reached latest sysctl entry.Reviewed by: jamieSponsored by: DARPA, AFRLSponsored by: HEIF5Differential Revision: https://reviews.freebsd.org/D8096
First pass through library packaging.Sponsored by: The FreeBSD Foundation
Add a package for jail(8) and related utilities.Sponsored by: The FreeBSD Foundation
META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.This both avoids some dependencies on xinstall.host and allowsbootstrapping on older releases to work due to lack of
META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.This both avoids some dependencies on xinstall.host and allowsbootstrapping on older releases to work due to lack of at least 'install -l'support.Sponsored by: EMC / Isilon Storage Division
Revert r284417 it is not necessary anymore
123