Commit Graph

6979 Commits

Author SHA1 Message Date
Florian Walpen
a9545eede4 Add idle priority scheduling privilege group to MAC/priority
Add an idletime user group that allows non-root users to run processes
with idle scheduling priority. Privileges are granted by a MAC policy in
the mac_priority module. For this purpose, the kernel privilege
PRIV_SCHED_IDPRIO was added to sys/priv.h (kernel module ABI change).

Deprecate the system wide sysctl(8) knob
security.bsd.unprivileged_idprio which lets any user run idle priority
processes, regardless of context. While the knob is still working, it is
marked as deprecated in the description and in the man pages.

MFC after:	2 weeks
Differential revision:	https://reviews.freebsd.org/D33338
2021-12-10 04:54:48 +02:00
Florian Walpen
bf2fa8d9d1 MAC/priority module for realtime privilege group
This is a MAC policy module that grants scheduling privileges based on
group membership.  Users or processes in the group realtime (gid 47) are
allowed to run threads and processes with realtime scheduling priority.
For timing-sensitive, low-latency software like audio/jack, running with
realtime priority helps to avoid stutter and gaps.

PR:	239125
MFC after:	2 weeks
Differential revision:	https://reviews.freebsd.org/D33191
2021-12-04 20:19:25 +02:00
Baptiste Daroussin
37d0601f42 bsddialog: import new TUI widget and utility
bsddialog is an attempt to write in permissive license a replacement for
libdialog.

While it is still in early stage it is good enough to already be used in
many areas, it is imported as private lib until it matures enough to be
considered as having a stable ABI
2021-11-24 11:03:31 +01:00
Dimitry Andric
6e75b2fbf9 Merge llvm-project release/13.x llvmorg-13.0.0-rc1-97-g23ba3732246a
This updates llvm, clang, compiler-rt, libc++, libunwind, lld, lldb and
openmp to llvmorg-13.0.0-rc1-97-g23ba3732246a.

PR:		258209
MFC after:	2 weeks
2021-11-13 21:42:03 +01:00
Dimitry Andric
fe6060f10f Merge llvm-project main llvmorg-13-init-16847-g88e66fa60ae5
This updates llvm, clang, compiler-rt, libc++, libunwind, lld, lldb and
openmp to llvmorg-13-init-16847-g88e66fa60ae5, the last commit before
the upstream release/13.x branch was created.

PR:		258209
MFC after:	2 weeks
2021-11-13 21:39:49 +01:00
Warner Losh
517e52b6c2 awk: Move to using two sets of tests
Upstream one-true-awk has two sets of tests. These are in addition to
NetBSD's tests we're using. The 'bugs-fixed' tests from upstream are
ready to use as-is (more or less). However, the 'tests' from upstream
are not, so for now we'll just use the netbsd and bugs-fixed tests.
They provide an OK workout and are better than nothing, though the tests
themselves are for specific esoteric things.

The upstream bugs-fixed tests are *ALMOST* a drop in. However, 3 test
for errors and the upstream test jig mashes stdout and stderr together,
which atf doesn't do, so make a tiny tweak to the upstream tests that I
hope to upstream. Plus upstream has ../a.out: instead of awk: in the
output. Not sure how to deal with this yet, so I've not proposed
anything upstream and have changed the test locally.

In addition, the system-status.awk test is not suitable to run in ATF.
It wants to force sh to dump core, but kyua doesn't seem to allow that
sometimes so the test will fail or pass based on whether or not a core
dump can be created. Since it's unstable, remove it.

This required moving the netbsd tests to a new direcotry, so update
mtree files as well. The change is useless for 'make check' without it.

Sponsored by:		Netflix
Differential Revision:	https://reviews.freebsd.org/D31376
2021-11-05 08:53:36 -06:00
Baptiste Daroussin
d410b585b6 sh(1): make it the default shell for the root user
In the recent history sh(1) has gain the missing features for it to
become a usable interractive shell:
- command completion
- persistent history support
- improvements on the default bindings in emacs mode
- improvements in the vi mode (repect $EDITOR)
- print a newline when exiting via ^D
- default prompt and improvements on how PS1 can be configured
- and more.

This changes also simplifies making tiny freebsd images with only sh(1)
as a shell
2021-10-20 09:34:05 +02:00
Antranig Vartanian
7955efd574 Add support for jail.conf.d
Using /etc/jail.{jailname}.conf is nice, however it makes /etc/ very
messy if you have many jails.  This patch allows one to move these
config files out of the way into /etc/jail.conf.d/{jailname}.conf.

Note that the same caveat as /etc/jail.*.conf applies: the jail service
will not autodiscover all of these for starting 'all' jails.  This is
considered future work, since the behavior matches.

Reviewed by:	kevans
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D24570
2021-09-10 00:30:04 -05:00
Piotr Pawel Stefaniak
f8e50dd2c6 Register /usr/tests/usr.bin/diff3
I wasn't able to make check to run diff3 tests, but kevans figured out
that I was missing diff3 in mtree.
2021-08-23 07:04:28 +02:00
Cyril Zhang
a85404906b vmm: Add credential to cdev object
Add a credential to the cdev object in sysctl_vmm_create(), then check
that we have the correct credentials in sysctl_vmm_destroy(). This
prevents a process in one jail from opening or destroying the /dev/vmm
file corresponding to a VM in a sibling jail.

Add regression tests.

Reviewed by:	jhb, markj
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D31156
2021-08-18 13:41:33 -04:00
Baptiste Daroussin
c982a41a0c mtree: remove a leftover '..' in BSD.usr.dist making it inconsistent
Reported by:	Michael Butler <imb@protected-networks.net>
2021-08-03 17:06:31 +02:00
Baptiste Daroussin
184d64af13 locales: stop hardcoding the directories in the mtree
The framework knows how to create directories and tag them properly
for a the creation of a mtree, not need to hardcode all the locales
entries in bsd.usr.mk

This simplifies addition of new locales but also allow people building
with WITHOUT_LOCALES to end up with a directory full of empty files
2021-08-03 14:25:00 +02:00
Martin Matuska
48b4fe0503 zfs: attach zpool_influxdb to build
From the zpool_influxdb.8 manual page:
  zpool_influxdb produces InfluxDB-line-protocol-compatible metrics from
  zpools.  Like the zpool command, zpool_influxdb reads the current pool
  status and statistics.  Unlike the zpool command which is intended for
  humans, zpool_influxdb formats the output in the InfluxDB line protocol.
  The expected use is as a plugin to a metrics collector or aggregator,
  such as Telegraf.

zpool_influxdb is installed into /usr/libexec/zfs/

Differential revision:	https://reviews.freebsd.org/D31094
MFC after:	3 days
2021-07-07 20:15:12 +02:00
Li-Wen Hsu
cb194afef5
sbin/md5: Create /usr/tests/sbin/md5 directory for placing tests
Sponsored by:	The FreeBSD Foundation
2021-06-25 18:29:46 +08:00
Dimitry Andric
23408297fb Merge llvm-project 12.0.1 rc2
This updates llvm, clang, compiler-rt, libc++, libunwind, lld, lldb and
openmp to llvmorg-12.0.1-rc2-0-ge7dac564cd0e, a.k.a. 12.0.1 rc2.

PR:		255570
MFC after:	6 weeks
2021-06-19 20:09:28 +02:00
Emmanuel Vadot
ed0a582d88 pkgbase: Put the last sendmail files in the sendmail package
Differential Revision:	https://reviews.freebsd.org/D30757
Sponsored by:	Diablotin Systems
2021-06-19 17:50:11 +02:00
Ceri Davies
64e6e1e463 secure/caroot, certctl: Rename secure/caroot/blacklisted
Old certctl commands still work for compatability, but are deprecated.

Approved by:	secteam (gordon)
Differential Revision: https://reviews.freebsd.org/D30807
2021-06-18 13:38:07 +01:00
Dimitry Andric
d409305fa3 Merge llvm-project 12.0.0 release
This updates llvm, clang, compiler-rt, libc++, libunwind, lld, lldb and
openmp to llvmorg-12.0.0-0-gd28af7c654d8, a.k.a. 12.0.0 release.

PR:		255570
MFC after:	6 weeks
2021-06-13 22:01:15 +02:00
Dimitry Andric
e8d8bef961 Merge llvm-project main llvmorg-12-init-17869-g8e464dd76bef
This updates llvm, clang, compiler-rt, libc++, libunwind, lld, lldb and
openmp to llvmorg-12-init-17869-g8e464dd76bef, the last commit before the
upstream release/12.x branch was created.

PR:		255570
MFC after:	6 weeks
2021-06-13 21:37:19 +02:00
Mark Johnston
186ba88a7c sort: Hook NetBSD tests up to the build
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2021-05-13 09:34:01 -04:00
Alan Somers
3b57d80c7a daemon: add some basic tests
MFC after:	2 weeks
Sponsored by:	Axcient
Differential Revision:	https://reviews.freebsd.org/D29316
2021-05-03 09:55:40 -06:00
Kyle Evans
f187d6dfbf base: remove if_wg(4) and associated utilities, manpage
After length decisions, we've decided that the if_wg(4) driver and
related work is not yet ready to live in the tree.  This driver has
larger security implications than many, and thus will be held to
more scrutiny than other drivers.

Please also see the related message sent to the freebsd-hackers@
and freebsd-arch@ lists by Kyle Evans <kevans@FreeBSD.org> on
2021/03/16, with the subject line "Removing WireGuard Support From Base"
for additional context.
2021-03-17 09:14:48 -05:00
Kyle Evans
74ae3f3e33 if_wg: import latest fixup work from the wireguard-freebsd project
This is the culmination of about a week of work from three developers to
fix a number of functional and security issues.  This patch consists of
work done by the following folks:

- Jason A. Donenfeld <Jason@zx2c4.com>
- Matt Dunwoodie <ncon@noconroy.net>
- Kyle Evans <kevans@FreeBSD.org>

Notable changes include:
- Packets are now correctly staged for processing once the handshake has
  completed, resulting in less packet loss in the interim.
- Various race conditions have been resolved, particularly w.r.t. socket
  and packet lifetime (panics)
- Various tests have been added to assure correct functionality and
  tooling conformance
- Many security issues have been addressed
- if_wg now maintains jail-friendly semantics: sockets are created in
  the interface's home vnet so that it can act as the sole network
  connection for a jail
- if_wg no longer fails to remove peer allowed-ips of 0.0.0.0/0
- if_wg now exports via ioctl a format that is future proof and
  complete.  It is additionally supported by the upstream
  wireguard-tools (which we plan to merge in to base soon)
- if_wg now conforms to the WireGuard protocol and is more closely
  aligned with security auditing guidelines

Note that the driver has been rebased away from using iflib.  iflib
poses a number of challenges for a cloned device trying to operate in a
vnet that are non-trivial to solve and adds complexity to the
implementation for little gain.

The crypto implementation that was previously added to the tree was a
super complex integration of what previously appeared in an old out of
tree Linux module, which has been reduced to crypto.c containing simple
boring reference implementations.  This is part of a near-to-mid term
goal to work with FreeBSD kernel crypto folks and take advantage of or
improve accelerated crypto already offered elsewhere.

There's additional test suite effort underway out-of-tree taking
advantage of the aforementioned jail-friendly semantics to test a number
of real-world topologies, based on netns.sh.

Also note that this is still a work in progress; work going further will
be much smaller in nature.

MFC after:	1 month (maybe)
2021-03-14 23:52:04 -05:00
Nathan Whitehorn
e77cf2a4ab Restore /boot/efi to mtree.
Instead of whether /boot/efi exists, which it now always does, including
on systems that don't and can't use EFI, use whether /boot/efi is
present in fstab to signal to the installer that it is a valid ESP and
should be configured. This has essentially the same semantics, but allows
/boot/efi to be created unconditionally.

Reviewed by:	bdragon, imp
Tested by:	bdragon (ppc64)
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D29068
2021-03-05 21:01:11 -05:00
Nathan Whitehorn
2c26d77d98 Remove /boot/efi from mtree, missed in 0b7472b3d8.
This had prevented the bootconfig step from determining if an ESP exists,
resulting in its unconditional setup. On BIOS-booted amd64, this wasn't
harmful, just unnecessary, but it resulted in failed installations on
non-EFI-supporting platforms like powerpc64.

MFC after:	3 days
2021-03-02 11:49:41 -05:00
ceri
1bf86687c2 etc/shells: Add a reference to the ftpd manpage
While here, also fix incorrect capitalizaiton
2021-02-26 14:09:19 +01:00
Robert Wing
5ce2d4a1c2 bhyve/snapshot: drop mkdir when creating the unix domain socket
Add /var/run/bhyve/ to BSD.var.dist so we don't have to call mkdir when
creating the unix domain socket for a given bhyve vm.

The path to the unix domain socket for a bhyve vm will now be
/var/run/bhyve/vmname instead of /var/run/bhyve/checkpoint/vmname

Move BHYVE_RUN_DIR from snapshot.c to snapshot.h so it can be shared
to bhyvectl(8).

Reviewed by: jhb
Differential Revision: https://reviews.freebsd.org/D28783
2021-02-22 11:31:07 -09:00
Martin Matuska
10f57cb98f zfs: bump version and install new share files
- bump version to 2.0.0-FreeBSD_gbf156c966
- install definition files for the new "-o compatibility" option
  to "zpool create"

MFC after:	2 weeks
2021-02-18 15:21:10 +01:00
Ed Maste
76b4234537 BSD.usr.dist: remove aout
Userland a.out support has been removed; kernel aout(5) is unchanged.

Sponsored by:	The FreeBSD Foundation
2021-01-07 19:14:01 -05:00
Vladimir Kondratyev
67de2db262 Factor-out hardware-independent part of USB HID support to new module
It will be used by the upcoming HID-over-i2C implementation.  Should be
no-op, except hid.ko module dependency is to be added to affected drivers.

Reviewed by:	hselasky, manu
Differential revision:	https://reviews.freebsd.org/D27867
2021-01-08 02:18:42 +03:00
Emmanuel Vadot
066a8c691e pkgbase: Install atf and kyua in the tests package
While here make sure that all tests dirs are taggued correctly.

Reviewed by:	bapt, emaste
Differential Revision:	https://reviews.freebsd.org/D27714
2021-01-04 16:20:47 +01:00
Dimitry Andric
eaeb601bd6 Merge llvm, clang, compiler-rt, libc++, libunwind, lld, lldb and openmp
release/11.x llvmorg-11.0.1-rc2-0-g43ff75f2c3f (aka 11.0.1 rc2).

MFC after:	4 weeks
X-MFC-With:	r364284
2021-01-03 13:54:24 +01:00
Kyle Evans
72cf7db3aa lualoader: add loader_conf_dirs support (loader.conf.d)
loader_conf_dirs is the supporting mechanism for the included
/boot/loader.conf.d directory.  When lualoader finishes processing all of
the loader_conf_files it finds after walking /boot/defaults/loader.conf,
it will now check any and all loader_conf_dirs and process files ending
in ".conf" as if they were a loader.conf.

Note that loader_conf_files may be specified in a loader.conf.d config
file, but loader_conf_dirs may *not*. It will only be processed as specified
in /boot/defaults/loader.conf and any loader_conf_files that were loaded
from there.

Reviewed by:	allanjude, freqlabs, rpokala, tsoome
Includes suggestion from:	imp
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D25608
2020-12-31 10:37:05 -06:00
Kyle Evans
8aff76fb37 build: remove the option to build gnugrep
Unconditionally install bsdgrep as grep, bootstrap or not. Remove all
build glue and stop installing both gnugrep and libgnuregex now that
all consumers of the latter are gone.

Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D27732
2020-12-25 15:14:17 -06:00
Nick Hibma
a70c318de4 Missed adding netgraph to mtree in r368443:
New Netgraph module ng_macfilter:

	Macfilter to route packets through different hooks based on sender MAC address.

	Based on ng_macfilter written by Pekka Nikander

	Sponsered by Retina b.v.

Reviewed by:    afedorov
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D27268
2020-12-08 17:44:34 +00:00
Nick Hibma
fa004e43f3 Fix indenting for netmap. 2020-12-08 17:42:32 +00:00
Alan Somers
3cde9171d2 Merge ping6 to ping
There is now a single ping binary, which chooses to use ICMP or ICMPv4
based on the -4 and -6 options, and the format of the address.

Submitted by:	Ján Sučan <sucanjan@gmail.com>
Sponsored by:	Google LLC (Google Summer of Code 2019)
MFC after:	Never
Differential Revision:	https://reviews.freebsd.org/D21377
2020-11-26 04:29:30 +00:00
Ryan Moeller
73577bf01d flua: Add a libjail module
libjail is pretty small, so it makes for a good proof of concept demonstrating
how a system library can be wrapped to create a loadable Lua module for flua.

* Introduce 3lua section for man pages
* Add libjail module

Reviewed by:	kevans, manpages
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D26080
2020-10-24 17:08:59 +00:00
Jakub Wojciech Klama
100353cfbf Add virtio-9p (aka VirtFS) filesystem sharing to bhyve.
VirtFS allows sharing an arbitrary directory tree between bhyve virtual
machine and the host. Current implementation has a fairly complete support
for 9P2000.L protocol, except for the extended attribute support. It has
been verified to work with the qemu-kvm hypervisor.

Reviewed by:	rgrimes, emaste, jhb, trasz
Approved by:	trasz (mentor)
MFC after:	1 month
Relnotes:	yes
Sponsored by:	Conclusive Engineering (development), vStack.com (funding)
Differential Revision:	https://reviews.freebsd.org/D10335
2020-10-03 19:05:13 +00:00
Kyle Evans
5028ea32d6 cp: add some basic tests
There are some tests available in the NetBSD test suite, but we don't
currently pass all of those; further investigation will go into that. For
now, just add a basic test as well as a test that copies from /dev/null to a
file.

The /dev/null test confirms that the file gets created if it's empty, then
that it truncates the file if it's non-empty. This matches some usage that
was previously employed in the build and was replaced in r366042 by a
simpler shell construct.

I will also plan on coming back to expand these in due time.

MFC after:	1 week
2020-09-23 03:01:14 +00:00
Dimitry Andric
de6fc2e39b Merge ^/head r364082 through r364250. 2020-08-15 11:49:31 +00:00
Ed Maste
bceabe277e flua: initial support for "require" in the base system
Use /usr not /usr/local for base system components.

Use /usr/lib/flua and /usr/share/flua (not lua) for consistency and to
avoid the possibility that other software accidentally finds our base
system modules.

Also drop the version from the path, as flua represents an unspecified
lua version that corresponds to the FreeBSD version it comes with.

LUA_USE_DLOPEN is not yet enabled because some additional changes are
needed wrt symbol visibility.

Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D24605
2020-08-13 00:19:05 +00:00
Dimitry Andric
e383ec74e5 Merge ^/head r363739 through r363986. 2020-08-06 19:34:55 +00:00
Dimitry Andric
48aaf27bca Update Makefiles under lib/clang and usr.bin/clang for 11.0.0 builds,
and also bump the version in the mtree files.
2020-08-06 19:30:00 +00:00
Stefan Eßer
f022d2cd17 Connect the tests provided with the new bc and dc
The tests compare the command output (including of error cases) with the
expected output and exit code.

Not all tests are executed, since some expect to have a known good bc and
dc binary installed and compare results of large amounts of generated data
being processed by both versions to test for regressions.
2020-08-03 20:26:04 +00:00
Yoshihiro Takahashi
8f11c99715 - Cleanups related to sparc64 removal.
- Remove remains of sparc64 files.

Reviewed by:	imp
Differential Revision:	https://reviews.freebsd.org/D25831
2020-07-28 10:58:37 +00:00
Tom Jones
3b01bf881c Add tests for "add", "change" and "delete" functionality of /sbin/route.
Add tests to cover "add", "change" and "delete" functionality of /sbin/route
for ipv4 and ipv6. These tests for the existing route tool are the first step
towards creating libroute.

Submitted by:   Ahsan Barkati
Sponsored by:   Google, Inc. (GSoC 2020)
Reviewed by:    kp, thj
Approved by:    bz (mentor)
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D25220
2020-07-22 13:49:54 +00:00
Gregory Neil Shapiro
5b0945b570 Merge sendmail 8.16.1 to HEAD: See contrib/sendmail/RELEASE_NOTES for details
Includes build infrastructure & config updates required for changes in 8.16.1

MFC after:	5 days
2020-07-15 18:28:54 +00:00
Olivier Cochard
d371ed1c4b Install extra TCP stack header files: They are needed to compile a userland
component of TCP Blackbox Recorder as example.

Approved by:	rrs
Sponsored by:	Netflix
Differential Revision:	https://reviews.freebsd.org/D25584
2020-07-08 21:40:27 +00:00
Conrad Meyer
a35bc248fd Restrict default /root permissions
Remove world-readability from the root directory.  Sensitive information may be
stored in /root and we diverge here from normative administrative practice, as
well as installation defaults of other Unix-alikes.  The wheel group is still
permitted to read the directory.

750 is no more restrictive than defaults for the rest of the open source
Unix-alike world.  In particular, Ben Woods surveyed DragonFly, NetBSD,
OpenBSD, ArchLinux, CentOS, Debian, Fedora, Slackware, and Ubuntu.  None have a
world-readable /root by default.

Submitted by:	Gordon Bergling <gbergling AT gmail.com>
Reviewed by:	ian, myself
Discussed with:	emaste (informal approval)
Relnotes:	sure?
Differential Revision:	https://reviews.freebsd.org/D23392
2020-06-04 16:04:19 +00:00