Changes in Makefile

6f636541 - capsicum tests: Serialize functional tests

Tue, 03 Sep 2024 14:39:02 +0000

capsicum tests: Serialize functional testsThe test suite runs the same tests twice, as different users, and thesecan trample over each other when run in parallel, causing spurious testfailures.MFC after: 1 week(cherry picked from commit 41ece3c036bda3d4da321989ee59d0555c10d603) List of files: /freebsd-14.2/tests/sys/capsicum/Makefile

d0b2dbfa - Remove $FreeBSD$: one-line sh pattern

Wed, 16 Aug 2023 17:55:03 +0000

Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /freebsd-14.2/tests/sys/capsicum/Makefile

c826e088 - Fix MK_TESTS build with MK_ASAN/MK_UBSAN

Mon, 02 Aug 2021 08:49:50 +0000

Fix MK_TESTS build with MK_ASAN/MK_UBSANReviewed By: markjDifferential Revision: https://reviews.freebsd.org/D31049 List of files: /freebsd-14.2/tests/sys/capsicum/Makefile

194d5628 - Make capsicum test cases fine-grained

Tue, 06 Oct 2020 06:45:52 +0000

Make capsicum test cases fine-grainedAdd a wrapping script to use ATF to run tests written with Googletestone by one. This helps locating and tracking the failing case in CI easier.This is a temporarily solution while Googletest support in Kyua is developing.We will revert this once Kyua+Googletest integration is ready.Reviewed by: emasteSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D25896 List of files: /freebsd-14.2/tests/sys/capsicum/Makefile

7cc42f6d - Do a sweep and remove most WARNS=6 settings

Thu, 01 Oct 2020 01:10:51 +0000

Do a sweep and remove most WARNS=6 settingsRepeating the default WARNS here makes it slightly more difficult toexperiment with default WARNS changes, e.g. if we did something absolutelybananas and introduced a WARNS=7 and wanted to try lifting the default tothat.Drop most of them; there is one in the blake2 kernel module, but I suspectit should be dropped -- the default WARNS in the rest of the build doesn'tcurrently apply to kernel modules, and I haven't put too much thought intowhether it makes sense to make it so. List of files: /freebsd-14.2/tests/sys/capsicum/Makefile

08e5c473 - Skip test if feature security_capabilities is not available

Fri, 29 Mar 2019 08:43:21 +0000

Skip test if feature security_capabilities is not availablePR: 236863Approved by: asomersMFC after: 1 monthSponsored by: Netflix List of files: /freebsd-14.2/tests/sys/capsicum/Makefile

2216c693 - Disable connectat/bindat with AT_FDCWD in capmode

Mon, 30 Apr 2018 17:31:06 +0000

Disable connectat/bindat with AT_FDCWD in capmodePreviously it was possible to connect a socket (which had theCAP_CONNECT right) by calling "connectat(AT_FDCWD, ...)" even incapabilties mode. This combination should be treated the same as a callto connect (i.e. forbidden in capabilities mode). Similarly for bindat.Disable connectat/bindat with AT_FDCWD in capabilities mode, fix up thedocumentation and add tests.PR: 222632Submitted by: Jan Kokemüller Reviewed by: Domagoj StolfaMFC after: 1 weekRelnotes: YesDifferential Revision: https://reviews.freebsd.org/D15221 List of files: /freebsd-14.2/tests/sys/capsicum/Makefile

8ce99bb4 - Properly do a deep copy of the ioctls capability array for fget_cap().

Tue, 17 Apr 2018 18:07:40 +0000

Properly do a deep copy of the ioctls capability array for fget_cap().fget_cap() tries to do a cheaper snapshot of a file descriptor withoutholding the file descriptor lock. This snapshot does not do a deepcopy of the ioctls capability array, but instead uses a differentreturn value to inform the caller to retry the copy with the lockheld. However, filecaps_copy() was returning 1 to indicate that aretry was required, and fget_cap() was checking for 0 (actually'!filecaps_copy()'). As a result, fget_cap() did not do a deep copyof the ioctls array and just reused the original pointer. This causemultiple file descriptor entries to think they owned the same pointerand eventually resulted in duplicate frees.The only code path that I'm aware of that triggers this is to create alisten socket that has a restricted list of ioctls and then callaccept() which calls fget_cap() with a valid filecaps structure fromgetsock_cap().To fix, change the return value of filecaps_copy() to return true ifit succeeds in copying the caps and false if it fails because the lockis required. I find this more intuitive than fixing the caller inthis case. While here, change the return type from 'int' to 'bool'.Finally, make filecaps_copy() more robust in the failure case by notcopying any of the source filecaps structure over. This avoids thepossibility of leaking a pointer into a structure if a similar futurecaller doesn't properly handle the return value from filecaps_copy()at the expense of one more branch.I also added a test case that panics before this change and now passes.Reviewed by: kibDiscussed with: mjg (not a fan of the extra branch)MFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D15047 List of files: /freebsd-14.2/tests/sys/capsicum/Makefile