1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
where it never would work anyhow, such as csu or loader. This suggests
there may be better ways of adding support to the tree. Many of these
cases can be fixed such that -fPIE will work but there is really no
reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
really building libraries but have been using bsd.prog.mk because the code
is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
been needed.
We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.
Reported by: kib
variants. This allows usable file system images (i.e. those with both a
shell and an editor) to be created with only one copy of the curses library.
Exp-run: antoine
PR: 189842
Discussed with: bapt
Sponsored by: DARPA, AFRL
This is currently an opt-in build flag. Once ASLR support is ready and stable
it should changed to opt-out and be enabled by default along with ASLR.
Each application Makefile uses opt-out to ensure that ASLR will be enabled by
default in new directories when the system is compiled with PIE/ASLR. [2]
Mark known build failures as NO_PIE for now.
The only known runtime failure was rtld.
[1] http://www.bsdcan.org/2014/schedule/events/452.en.html
Submitted by: Shawn Webb <lattera@gmail.com>
Discussed between: des@ and Shawn Webb [2]
current version of FreeBSD, this isn't guarenteed by the API. Custom
security modules, or future implementations of the setuid and setgid
may fail.
PR: bin/172289
PR: bin/172290
PR: bin/172291
Submittud by: Erik Cederstrand <erik@cederstrand.dk>
Discussed by: freebsd-security
Approved by: cperciva
MFC after: 1 week
the queue is not 'lpc stop'-ed. In that situation `lpq' will
not display the status message to the user, and the operator
may think the queue is already stopped when it is not.
MFC after: 3 weeks
int (*compar)(const struct dirent **, const struct dirent **)
The current code defines sortq() to accept two void *, then cast them
to const struct dirent **. Because the code does not really need this
cast, we can eliminate the casts by changing the function prototype
to match scandir(3) expectation.
MFC after: 1 month
system callers of getgroups(), getgrouplist(), and setgroups() to
allocate buffers dynamically. Specifically, allocate a buffer of size
sysconf(_SC_NGROUPS_MAX)+1 (+2 in a few cases to allow for overflow).
This (or similar gymnastics) is required for the code to actually follow
the POSIX.1-2008 specification where {NGROUPS_MAX} may differ at runtime
and where getgroups may return {NGROUPS_MAX}+1 results on systems like
FreeBSD which include the primary group.
In id(1), don't pointlessly add the primary group to the list of all
groups, it is always the first result from getgroups(). In principle
the old code was more portable, but this was only done in one of the two
places where getgroups() was called to the overall effect was pointless.
Document the actual POSIX requirements in the getgroups(2) and
setgroups(2) manpages. We do not yet support a dynamic NGROUPS, but we
may in the future.
MFC after: 2 weeks
properly initialized, that happens when lpc is called from a tty.
Without this change, it's possible to get SIGSEGV simply doing:
echo "..:" | lpc
Reported by: Wojciech A. Koszek <dunstan at freebsd czest pl>
PR: 77462 (patch rewritten by myself)
MFC After: 1 week
character 1 byte past the end of cmdline[] when libedit is being used for
input, and avoid writing a null pointer 1 element past the end of margv[].
Reviewed by: gad
format of 'sccsid' lines so they consistently match style(9)
guidelines. Note that this means you will have to add '-a' to
the 'strings' command when searching for rcs ids, eg:
strings -a /usr/sbin/lpc | grep '$FreeBSD'
Reviewed by: discussed on cvs-src & with bde and obrien
MFC after: 15 days
reflect much valuable feedback from wollman. More details on the new
'lpc topq' are in the log message for revision 1.2 of lpc/movejobs.c.
The previous implementation of 'lpc topq' is available as 'lpc xtopq',
in case there are any problems noticed in the new implementation. If
there are no problems with this version, a later update will remove the
'lpc xtopq' command.
Reviewed by: freebsd-print@bostonradio.org
MFC after: 6 days
visible change should be that more than one queue can now be specified,
if one uses the '-msg' parameter to separate the list of queues from the
status message to set.
The previous implementation of 'down' remains available as the command
'xdown', available for instant fallback if there seems to be anything
wrong with the new one. If no one reports a problem after a few weeks,
then a later update will remove 'xdown'.
Reviewed by: freebsd-print@bostonradio.org
MFC after: 10 days
change the status message of a print queue. This includes some minor
changes to the upstat() routine, so that error messages are not printed
while seteuid(priv-user).
Reviewed by: freebsd-audit and freebsd-print@bostonradio.org
MFC after: 10 days
'restart', 'start', 'stop' and 'up'. These are commands which mainly
just alter the access bits on the lock-file of a queue, and they all
now use a central routine to do that. This reduces the amount of code
that is run as the priv userid, and eliminates a number of cases where
error messages were written while that priv uid was in effect.
As far as users are concerned, there should be no noticable difference
in the new versions. In case there *is*, the previous implementations
are still there as 'xabort', 'xenable', etc, so they are available for
instant fallback. If no one reports a problem after a few weeks, then
a later update will remove those x-commands.
Reviewed by: freebsd-audit and freebsd-print@bostonradio.org
MFC after: 10 days
control-files will always start with 'cfA*'. It turns out that some
implementations of lpd (such as solaris) may send a control file which
starts with 'cfB*', or really 'cf<anyLetter>*'. Although such filenames
are very odd, we did used to accept them. This changes ctl_renametf to
work correctly with them, and fixes up 'lpc clean' to match.
PR: bin/32183
MFC after: 10 days
'lpc tclean'. In some obscure cases, the previous version could cause a
valid user job to be removed (by 'clean'), due to invalid assumptions in
the sort routine. This was a rare problem, unless ctlinfo.c is compiled
with 'LEAVE_TMPCF_FILES' turned on (to check what that rtn was doing).
Reviewed by: Lack of outcry on -audit and freebsd-print@bostonradio.org
MFC after: 10 days
often by just telling gcc that some internal routine is "__printflike"
(work done by Kris Kennaway <kris@FreeBSD.org>). Also fix the new warnings
which show up once gcc starts checking the "printf-like parameters" passed
to those routines.
MFC after: 1 week
one to see what files would be removed *if* an 'lpc clean' is done. 'tclean'
will remove no files, and is therefore not a privileged command. Also, both
'lpc clean' and 'lpc tclean' will now look for 'core' files in spool directories
(but not remove them). They also print out an extra line of info when a
datafile to be removed is a symlink (from 'lpr -s'), saying what file it is
a symlink to.
The 'lpc clean' commands also now print out a summary line saying how many
queues were checked, how many files were removed (or "would be" removed, for
tclean), and how much disk space is involved. For the benefit of those who
have many print queues, 'lpc clean all' will only print out the names of print
queues where some "interesting" files were found, instead of printing out a
header-line for every queue in your printcap file.
Reviewed by: freebsd-print@bostonradio.orgfreebsd-audit@FreeBSD.org
MFC after: 2 weeks
warnings which come up for various routines that have a parameter which
is also called 'name'.
Reviewed by: freebsd-print@bostonradio.org
MFC after: 1 week
