Commit Graph

129 Commits

Author SHA1 Message Date
Olivier Cochard
f1c010d9f9 tests: Skip cap_fileargs if build without capsicum capabilities
Approved by:    oshogbo
Sponsored by:   Netflix
Differential Revision: https://reviews.freebsd.org/D2834
2021-01-26 22:19:36 +01:00
Mark Johnston
1a05d9519d libcasper/cap_grp tests: Reset the group database handle
Some tests verify that the capgrp capability does not permit calls to
setgrent(3), but all tests need to ensure that they reset the
capability's group database handle, otherwise the local process and
casper process will be out of sync.

The cap_pwd tests already handle this.

Sponsored by:	The FreeBSD Foundation
MFC after:	1 month
2021-01-21 14:30:19 -05:00
Mariusz Zaborski
d2ceee38ca casper: convert macros to inline functions
In libcasper, the first argument to the function is a structure that
represents a connection to Casper. On systems without Casper, macros
are used to interpose the Casper functions to standard libc ones.
This may cause errors/warnings that the variable is not used.
With the inline function, there is no such problem.

I omitted this file in: 8c121177f0
2021-01-12 19:40:45 +01:00
Mariusz Zaborski
dcdad29947 fileargs: add support for realpath 2021-01-10 12:44:06 +01:00
Mariusz Zaborski
faaf43b2a7 fileargs: add tests 2021-01-09 21:56:09 +01:00
Mariusz Zaborski
459511895e cap_sysctl: expose structures and variables
Expose structures and variables that may be used on systems
build without Casper support.
2021-01-04 20:56:07 +01:00
Mariusz Zaborski
8c121177f0 casper: convert macros to inline functions
In libcasper, the first argument to the function is a structure that
represents a connection to Casper. On systems without Casper, macros
are used to interpose the Casper functions to standard libc ones.
This may cause errors/warnings that the variable is not used.
With the inline function, there is no such problem.
2021-01-04 20:55:35 +01:00
Mariusz Zaborski
34535dace9 cap_net: CAPNET_CONNECT and CAPNET_CONNECTDNS are not mutually exclusive
Fix the for the CAPNET_CONNECT and CAPNET_CONNECTDNS.
Add test to ensure that this is possible.
2021-01-03 17:10:35 +01:00
Mariusz Zaborski
b7876aec95 cap_net: allow to use the service without setting the limits
Add test to ensure that this is possible.
2021-01-03 17:09:20 +01:00
Mariusz Zaborski
4084669d18 capser: add cap_net to the list of services 2021-01-03 16:55:35 +01:00
Adrian Chadd
388197f414 [libcasper] Update cap_dns API to not trigger unused variable warnings when disabled
When compiling without casper these API calls result in unused variable warnings.
Using #defines was lovely in the past but unfortunately it triggers warnings
which can cascade into errors.

Instead, just inline with some fallthrough functions and keep things happy.

Tested:

* gcc-6 targeting mips32, with casper disabled

Reviewed by:	emaste
Differential Revision:	https://reviews.freebsd.org/D26762
2020-10-13 22:49:43 +00:00
Kyle Evans
fe815331bb build: provide a default WARNS for all in-tree builds
The current default is provided in various Makefile.inc in some top-level
directories and covers a good portion of the tree, but doesn't cover parts
of the build a little deeper (e.g. libcasper).

Provide a default in src.sys.mk and set WARNS to it in bsd.sys.mk if that
variable is defined. This lets us relatively cleanly provide a default WARNS
no matter where you're building in the src tree without breaking things
outside of the tree.

Crunchgen has been updated as a bootstrap tool to work on this change
because it needs r365605 at a minimum to succeed. The cleanup necessary to
successfully walk over this change on WITHOUT_CLEAN builds has been added.

There is a supplemental project to this to list all of the warnings that are
encountered when the environment has WARNS=6 NO_WERROR=yes:
https://warns.kevans.dev -- this project will hopefully eventually go away
in favor of CI doing a much better job than it.

Reviewed by:	emaste, brooks, ngie (all earlier version)
Reviewed by:	emaste, arichardson (depend-cleanup.sh change)
Differential Revision:	https://reviews.freebsd.org/D26455
2020-09-18 17:17:46 +00:00
Mariusz Zaborski
832dc76b63 libcasper: Introduce cap_net a network service for Casper.
Reviewed by:	emaste, markj (previous version), bcr (man page)
Differential Revision:	https://reviews.freebsd.org/D24688
2020-08-16 18:12:21 +00:00
Mateusz Piotrowski
f4b792fa67 Fix trailing-comma-related typos in the tree when the Xr macro is used
MFC after:	1 week
2020-06-27 11:13:45 +00:00
Gordon Bergling
421f325efc libcasper(3): Document HISTORY within the manpages
Reviewed by:	bcr (mentor)
Approved by:	bcr (mentor)
MFC after:		7 days
Differential Revision:	https://reviews.freebsd.org/D24695
2020-06-16 16:48:52 +00:00
Mark Johnston
c78e42e207 cap_fileargs: Fix a descriptor leak in the service process.
The service handler for fileargs_open() tries to pre-open multiple files
and pass descriptors for each back to the sandboxed process in a single
message.  This is to amortize the cost of round-trips between the two
processes.

The service process adds a "cache" nvlist to the reply to "open",
containing file descriptors for pre-opened files.  However, when adding
that nvlist to the reply, it was making a copy, effectively leaking the
cached descriptors.

While here, fix spelling in a local variable name.

PR:		241226
Reviewed by:	oshogbo
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D25095
2020-06-01 15:32:13 +00:00
Alan Somers
133b8ab5bb cap_dns.3: fix some orphan .Xr links
Reported by:	phk
MFC after:	2 weeks
2020-04-18 20:13:43 +00:00
Conrad Meyer
b30c6ac9f9 libcasper(3): Export functions to C++
We must wrap C declarations in __BEGIN / __END_DECLS to avoid C++ name-mangling
of the declaration when including the C header; name-mangling causes the linker
to attempt to locate the wrong (C++ ABI) symbol name.

Reviewed by:	markj, oshogbo (earlier version both)
Differential Revision:	https://reviews.freebsd.org/D24323
2020-04-07 16:40:41 +00:00
Conrad Meyer
2750f1b954 libcasper: Constify cap_sysctl_limit_mib() mib parameter
No functional change. Minor API change that is nicer for consumers. ABI is
identical; the routine never needed to modify the pointed to value.

Reviewed by:	emaste, markj
Differential Revision:	https://reviews.freebsd.org/D24319
2020-04-06 23:07:56 +00:00
Simon J. Gerraty
2c9a9dfc18 Update Makefile.depend files
Update a bunch of Makefile.depend files as
a result of adding Makefile.depend.options files

Reviewed by:	 bdrewery
MFC after:	1 week
Sponsored by:   Juniper Networks
Differential Revision:  https://reviews.freebsd.org/D22494
2019-12-11 17:37:53 +00:00
Kyle Evans
b3bec79d36 cap_sysctl: correct typo from r347534-ish
operation & ~limit where limit is a bool is clearly not what was intended,
given the line prior. Correct it to use the calculated mask for validation.

The cap_sysctl tests should now be functional again.
2019-10-23 03:23:14 +00:00
Kyle Evans
e735aa5a74 libcasper/services: include <src.opts.mk> to hook tests to build
Note that the cap_sysctl tests are currently failing and need some
attention.
2019-10-23 01:50:41 +00:00
Emmanuel Vadot
724fad3ad0 pkgbase: Move libcap_ to FreeBSD-runtime
A lot of binaries present in FreeBSD-runtime depend on it so move
the libs there.

Reviewed by:	bapt, gjb
Differential Revision:	https://reviews.freebsd.org/D21501
2019-09-05 14:10:26 +00:00
Mariusz Zaborski
9509775394 cap_filergs: limit size of the file name
The limit of the name in fileargs is twice the size of the MAXPATH.
The nvlist will not add an element with the longer name.
We can detect at this point that the path is too big, and simple return
the same error as open(2) would.

PR:		239700
Reported by:	markj
Tested by:	markj
MFC after:	2 weeks
2019-08-07 19:30:33 +00:00
Mariusz Zaborski
64b3a6b3b3 fileargs: fix formating in EXAMPLES
PR:		239523
Submitted by:	mikael.urankar@gmail.com
2019-07-30 08:53:03 +00:00
Mariusz Zaborski
8cf7941693 libcasper: remove reference to deprecated system.random 2019-07-29 21:26:26 +00:00
Mark Johnston
a76f78dc3f Remove cap_random(3).
Now that we have a way to obtain entropy in capability mode
(getrandom(2)), libcap_random is obsolete.  Remove it.

Bump __FreeBSD_version in case anything happens to use it, though I've
found no consumers.

Reviewed by:	delphij, emaste, oshogbo
Relnotes:	yes
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D21033
2019-07-24 22:50:43 +00:00
Mark Johnston
89e9665b8d Link fileargs_lstat.3.
Sponsored by:	The FreeBSD Foundation
2019-07-21 16:35:49 +00:00
Mariusz Zaborski
4b3f792718 fileargs: add wrapping/unwrapping functions
Those function may be useful to pass fileargs connections around.
2019-06-12 19:31:26 +00:00
Mark Johnston
adbb25df4b Extend the libcap_sysctl tests.
- Add some coverage for cap_sysctl(3).
- Add a test for the case where the caller wishes to find the sysctl
  output length without specifying an output buffer.

Reviewed by:	oshogbo
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D17856
2019-05-13 17:53:03 +00:00
Mark Johnston
3c766430f7 Convert the libcap_sysctl test cases to ATF.
Reviewed by:	oshogbo
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D17855
2019-05-13 17:51:03 +00:00
Mark Johnston
1608c46ea4 Add cap_sysctl(3) and cap_sysctlnametomib(3).
These complement cap_sysctlbyname(3) to provide a drop-in
replacement for the corresponding libc functions.

Also revise the libcap_sysctl limit interface to provide access
to sysctls by MIB, and to avoid direct manipulation of nvlists
by the caller.

Reviewed by:	oshogbo
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D17854
2019-05-13 17:49:54 +00:00
Adrian Chadd
d2fd7f28fe [casper] fix compilation when casper is disabled.
This triggers an error in gcc-mips 6.4.0 complaining about unused arguments.

Tested:

* compiled/run on mips32; nothing complained.
2019-04-17 16:58:38 +00:00
Ed Maste
151744cf5c cap_fileargs: fix test after r346318
Reported by:	danfe, mjg
MFC after:	3 weeks
MFC with:	r346315
Sponsored by:	The FreeBSD Foundation
2019-04-17 16:45:42 +00:00
Ed Maste
b6539d47bd cap_fileargs: fix GCC build, don't shadow 'stat'
Reported by:	ci.freebsd.org
MFC after:	3 weeks
MFC with:	r346315
Sponsored by:	The FreeBSD Foundation
2019-04-17 16:31:30 +00:00
Ed Maste
7b558caee3 cap_fileargs: add fileargs_lstat service
Add fileargs_lstat function to cap_fileargs casper service to be able to
lstat files while in capability mode.  It can only lstat files given in
fileargs_init.

Submitted by:	Bora Özarslan <borako.ozarslan@gmail.com>
Reviewed by:	oshogbo, cem (partial)
MFC after:	3 weeks
Relnotes:	Yes
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D19548
2019-04-17 16:02:57 +00:00
Ed Maste
fc07a84f80 cap_fileargs.3: typo and markup corrections
Submitted by:	Bora Özarslan" <borako.ozarslan@gmail.com>
MFC after:	1 week
MFC with:	r346313
Sponsored by:	The FreeBSD Foundation
2019-04-17 16:00:33 +00:00
Ed Maste
731d06abf2 cap_fileargs.3: correct 'filerags' typo
Submitted by:	Bora Özarslan" <borako.ozarslan@gmail.com>
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2019-04-17 15:48:33 +00:00
Jason A. Harmening
f048354550 r341692 changed cap_syslog(3) to preserve the stdio descriptors inherited
from its parent so that LOG_PERROR would work.  However, this caused
dhclient(8)'s stdio streams to remain open across daemonization, breaking
the ability to capture its foreground output as done in netconfig_ipv4.

Fix this by reverting r341692 and instead passing the parent's stderr
descriptor as an argument to cap_openlog() only when LOG_PERROR is specified
in logopt.

PR:	234514
Suggested by:	markj
Reported by:	Shawn Webb
Reviewed by:	markj, oshogbo
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D18989
2019-02-06 04:36:28 +00:00
Mariusz Zaborski
28f4385e45 libcasper: do not run registered exit functions
Casper library should not use exit(3) function because before setting it up
applications may register it. Casper doesn't depend on any registered exit
function, so it safe to change this.

Reported by:	jceel
MFC after:	2 weeks
2019-01-26 14:10:49 +00:00
Mark Johnston
08c4a937a6 Let the cap_syslog capability inherit stdio descriptors.
Otherwise cap_openlog(LOG_PERROR) doesn't work.

Reviewed by:	oshogbo
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D18457
2018-12-07 15:52:50 +00:00
Mariusz Zaborski
77ebcc05ea libcasper: do not fail if Capsicum is not avilable
Casper service can be also used on the kernels without Capsicum support.

Reported by:	sbruno
Tested by:	sbruno
2018-11-30 19:27:14 +00:00
Mariusz Zaborski
2863fd2f27 libcasper: provide compatibility with the old version of service
Some external tools like tcpdump(1) have upstream the changes with old limits
name. Because of that provide compatibility with the old names.

Reported by:	emaste
2018-11-19 17:22:52 +00:00
Mariusz Zaborski
fd253945ac Update the names in the LIMITS and EXAMPLES sections after r340363.
Reported by:	markj
2018-11-18 11:11:27 +00:00
Mariusz Zaborski
2607c01b66 Fix typo in the comparison.
This fix build with gcc.

Reported by:	jenkins
2018-11-12 18:37:31 +00:00
Mariusz Zaborski
cdd6ea94b0 libcasper: introduce cap_fileargs service
cap_fileargs is a Casper service which helps to sandbox applications that need
access to the filesystem namespace. The main purpose of the service is to make
easy to capsicumize applications that works on multiple files passed in argv.

We have a couple example of using it but we still treat this service as an
experimental one.

Reviewed by:	emsate (previous version), jonathan (partially)
Discussed with:	many
Differential Revision:	https://reviews.freebsd.org/D14407
2018-11-12 17:40:47 +00:00
Mariusz Zaborski
752d135e0d libcasper: ange the name of limits in cap_dns so the intentions are obvious.
Reported by:	pjd
MFC after:	3 weeks
2018-11-12 15:52:45 +00:00
Mark Johnston
35b4d0f125 Document the fact that cap_limit_set() always frees the input nvlist.
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2018-11-05 21:01:45 +00:00
Mariusz Zaborski
d9c2248dd5 libcasper: using explicit_bzero in cap_grp service
Please notice that we still don't clean information in nvlist structures.

Submitted by:	David CARLIER <devnexen@gmail.com>
Differential Revision:	https://reviews.freebsd.org/D16777
2018-11-04 19:43:59 +00:00
Mariusz Zaborski
577dff6a8d libcasper: fix limitations in dns service
The getaddrinfo(3) and gethostbyname(3) are used to return the address for a
given hostname. The getnameinfo(3) and gethostbyaddr(3) are used to return
hostname for a given address. Right now in casper, we have two limitations:
- NAME which allows resolving DNS names.
- ADDR which allows to do revert DNS lookups.

Before this change the rights was mixed up:
NAME - getnameinfo(3) and gethostbyname(3)
ADDR - gethostbyaddr(3) and getaddrinfo(3)

Which no matters on limitation allowed us to resolve DNS names and do DNS
lookups basically by using a different set of functions.

Now the NAME type allows getaddrinfo(3) and gethostbyname (3)functions,
and the ADDR names allow to use gethostbyaddr(3) and getnameinfo(3) functions.

Reviewed by:	pjd, bcr
MFC after:	3 weeks
Discussed with:	hrs
Differential Revision:	https://reviews.freebsd.org/D16930
2018-11-04 19:38:54 +00:00