Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

tests/sys/audit: force PIE off

df093aa9463b linked against libprivateauditd.a, but that is currently
(and incorrectly) built as position-dependent. For now just force PIE
off for this test to fix t

tests/sys/audit: force PIE off

df093aa9463b linked against libprivateauditd.a, but that is currently
(and incorrectly) built as position-dependent. For now just force PIE
off for this test to fix the WITH_PIE build.

Sponsored by: The FreeBSD Foundation

show more ...

tests/sys/audit: Avoid race caused by starting auditd(8) for testing

In the CheriBSD CI we reproducibly see the first test in sys/audit
(administrative:acct_failure) fail due to a missing startup me

tests/sys/audit: Avoid race caused by starting auditd(8) for testing

In the CheriBSD CI we reproducibly see the first test in sys/audit
(administrative:acct_failure) fail due to a missing startup message.
It appears this is caused by a race condition when starting auditd:
`service auditd onestart` returns as soon as the initial auditd() parent
exits (after the daemon(3) call).
We can avoid this problem by setting up the auditd infrastructure
in-process: libauditd contains audit_quick_{start,stop}() functions that
look like they are ideally suited to this task.
This patch also avoids forking lots of shell processes for each of the 418
tests by using `auditon(A_SENDTRIGGER, &trigger, sizeof(trigger))` to check
for a running auditd(8) instead of using `service auditd onestatus`.

With these two changes (and D28388 to fix the XFAIL'd test) I can now
boot and run `cd /usr/tests/sys/audit && kyua test` without any failures
in a single-core QEMU instance. Before there would always be at least one
failed test.

Besides making the tests more reliable in CI, a nice side-effect of this
change is that it also significantly speeds up running them by avoiding
lots of fork()/execve() caused by shell scripts:
Running kyua test on an AArch64 QEMU took 315s before and now takes 68s,
so it's roughly 3.5 times faster. This effect is even larger when running
on a CHERI-RISC-V QEMU since emulating CHERI instructions on an x86 host
is noticeably slower than emulating AArch64.

Test Plan: aarch64+amd64 QEMU no longer fail.

Reviewed By: asomers
Differential Revision: https://reviews.freebsd.org/D28451

show more ...

Do a sweep and remove most WARNS=6 settings

Repeating the default WARNS here makes it slightly more difficult to
experiment with default WARNS changes, e.g. if we did something absolutely
bananas an

Do a sweep and remove most WARNS=6 settings

Repeating the default WARNS here makes it slightly more difficult to
experiment with default WARNS changes, e.g. if we did something absolutely
bananas and introduced a WARNS=7 and wanted to try lifting the default to
that.

Drop most of them; there is one in the blake2 kernel module, but I suspect
it should be dropped -- the default WARNS in the rest of the build doesn't
currently apply to kernel modules, and I haven't put too much thought into
whether it makes sense to make it so.

show more ...

Make audit tests depend on /dev/auditpipe. This should fix
some 416 failing tests on armv7:

https://ci.freebsd.org/job/FreeBSD-head-armv7-test/lastCompletedBuild/testReport/

Reviewed by: asomers
MF

Make audit tests depend on /dev/auditpipe. This should fix
some 416 failing tests on armv7:

https://ci.freebsd.org/job/FreeBSD-head-armv7-test/lastCompletedBuild/testReport/

Reviewed by: asomers
MFC after: 2 weeks
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D25144

show more ...

Fix and simplify code by using ATF_REQUIRE_FEATURE macro

PR: 236857
Reviewed by: asomers, ngie
Approved by: emaste
MFC after: 1 month
Sponsored by: Netflix

audit(4) tests: require /etc/rc.d/auditd

These tests should be skipped if /etc/rc.d/auditd is missing, which could be
the case if world was built with WITHOUT_AUDIT set. Also, one test case
require

audit(4) tests: require /etc/rc.d/auditd

These tests should be skipped if /etc/rc.d/auditd is missing, which could be
the case if world was built with WITHOUT_AUDIT set. Also, one test case
requires /etc/rc.d/accounting.

Submitted by: ngie
MFC after: 2 weeks
Pull Request: https://github.com/freebsd/freebsd/pull/240

show more ...

audit(4): add tests for sysctl(3) and sysarch(2)

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D16116

audit(4): add tests for the process-control audit class

Tested syscalls include rfork(2), chdir(2), fchdir(2), chroot(2),
getresuid(2), getresgid(2), setpriority(2), setgroups(2), setpgrp(2),
setrli

audit(4): add tests for the process-control audit class

Tested syscalls include rfork(2), chdir(2), fchdir(2), chroot(2),
getresuid(2), getresgid(2), setpriority(2), setgroups(2), setpgrp(2),
setrlimit(2), setlogin(2), mlock(2), munlock(2), minherit(2), rtprio(2),
profil(2), ktrace(2), ptrace(2), fork(2), umask(2), setuid(2), setgid(2),
seteuid(2), and setegid(2). The last six are only tested in the success
case, either because they're infalliable or a failure is difficult to cause
on-demand.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15966

show more ...

audit(4): add tests for ioctl(2)

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15872

audit(4): Add tests for a few syscalls in the ad class

The ad audit class is for administrative commands. This commit adds test
for settimeofday, adjtime, and getfh.

Submitted by: aniketp
MFC afte

audit(4): Add tests for a few syscalls in the ad class

The ad audit class is for administrative commands. This commit adds test
for settimeofday, adjtime, and getfh.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15861

show more ...

audit(4): add tests for POSIX message queues

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15848

audit(4): Add a few tests for network-related syscalls

Add tests for socket(2), socketpair(2), and setsockopt(2)

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Diff

audit(4): Add a few tests for network-related syscalls

Add tests for socket(2), socketpair(2), and setsockopt(2)

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15803

show more ...

audit(4): fix typo from r335136

Typo in Makefile accidentally disabled some older tests

MFC after: 2 weeks
X-MFC-With: 335136

audit(4): add tests for flock, fcntl, and fsync

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15795

audit(4): add tests for stat(2) and friends

This revision adds auditability tests for stat, lstat, fstat, and fstatat,
all from the fa audit class. More tests from that audit class will follow.

Su

audit(4): add tests for stat(2) and friends

This revision adds auditability tests for stat, lstat, fstat, and fstatat,
all from the fa audit class. More tests from that audit class will follow.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15709

show more ...

audit(4): add tests for open(2) and openat(2)

These syscalls are atypical, because each one corresponds to several
different audit events, and they each pass several different audit class
filters.

audit(4): add tests for open(2) and openat(2)

These syscalls are atypical, because each one corresponds to several
different audit events, and they each pass several different audit class
filters.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15657

show more ...

audit(4): add tests for the cl audit class

The only syscalls in this class are close, closefrom, munmap, and revoke.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)

audit(4): add tests for the cl audit class

The only syscalls in this class are close, closefrom, munmap, and revoke.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15650

show more ...

audit(4): add tests for the fd audit class

The only syscalls in this class are rmdir, unlink, unlinkat, rename, and
renameat. Also, set is_exclusive for all audit(4) tests, because they can
start a

audit(4): add tests for the fd audit class

The only syscalls in this class are rmdir, unlink, unlinkat, rename, and
renameat. Also, set is_exclusive for all audit(4) tests, because they can
start and stop auditd.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15647

show more ...

audit(4): Add tests for the fw class of syscalls.

truncate and ftruncate are the only syscalls in this class, apart from
certain variations of open and openat, which will be handled in a different
f

audit(4): Add tests for the fw class of syscalls.

truncate and ftruncate are the only syscalls in this class, apart from
certain variations of open and openat, which will be handled in a different
file.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15640

show more ...

audit(4): Add tests for the fr class of syscalls

readlink and readlinkat are the only syscalls in this class. open and
openat are as well, but they'll be handled in a different file. Also, tidy
up

audit(4): Add tests for the fr class of syscalls

readlink and readlinkat are the only syscalls in this class. open and
openat are as well, but they'll be handled in a different file. Also, tidy
up the copyright headers of recently added files in this area.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15636

show more ...

Add initial set of tests for audit(4)

This change includes the framework for testing the auditability of various
syscalls, and includes changes for the first 12. The tests will start
auditd(8) if n

Add initial set of tests for audit(4)

This change includes the framework for testing the auditability of various
syscalls, and includes changes for the first 12. The tests will start
auditd(8) if needed, though they'll be much faster if it's already running.
The syscalls tested in this commit include mkdir(2), mkdirat(2), mknod(2),
mknodat(2), mkfifo(2), mkfifoat(2), link(2), linkat(2), symlink(2),
symlinkat(2), rename(2), and renameat(2).

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15286

show more ...