When comparing to the timestamp of a given file using -newer, -Xnewer and
-newerXY (where X and Y are one of m, c, a, B), include nanoseconds in the
comparison.
The primaries that compare a timestamp of a file to a given value (-Xmin,
-Xtime, -newerXt) continue to compare times in whole seconds.
Note that the default value 0 of vfs.timestamp_precision almost always
causes the nanoseconds part to be 0. However, touch -d can set a timestamp
to the microsecond regardless of that sysctl.
MFC after: 1 week
match our import of the (un)vis(3) APIs.
This adds support for multibyte encoding and the -h and -m flags which
support HTTP and MIME encoding respectively.
PR: bin/175418
Obtained from: NetBSD
in the manpage by having it display the current CPU (ki_oncpu) rather
than the previously used CPU (ki_lastcpu). ki_lastcpu is still used for
all other thread states.
Reported by: Chris Ross <cross+freebsd@distal.com>
MFC after: 1 week
int bindat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen);
int connectat(int fd, int s, const struct sockaddr *name, socklen_t namelen);
which allow to bind and connect respectively to a UNIX domain socket with a
path relative to the directory associated with the given file descriptor 'fd'.
- Add manual pages for the new syscalls.
- Make the new syscalls available for processes in capability mode sandbox.
- Add capability rights CAP_BINDAT and CAP_CONNECTAT that has to be present on
the directory descriptor for the syscalls to work.
- Update audit(4) to support those two new syscalls and to handle path
in sockaddr_un structure relative to the given directory descriptor.
- Update procstat(1) to recognize the new capability rights.
- Document the new capability rights in cap_rights_limit(2).
Sponsored by: The FreeBSD Foundation
Discussed with: rwatson, jilles, kib, des
- Capability is no longer separate descriptor type. Now every descriptor
has set of its own capability rights.
- The cap_new(2) system call is left, but it is no longer documented and
should not be used in new code.
- The new syscall cap_rights_limit(2) should be used instead of
cap_new(2), which limits capability rights of the given descriptor
without creating a new one.
- The cap_getrights(2) syscall is renamed to cap_rights_get(2).
- If CAP_IOCTL capability right is present we can further reduce allowed
ioctls list with the new cap_ioctls_limit(2) syscall. List of allowed
ioctls can be retrived with cap_ioctls_get(2) syscall.
- If CAP_FCNTL capability right is present we can further reduce fcntls
that can be used with the new cap_fcntls_limit(2) syscall and retrive
them with cap_fcntls_get(2).
- To support ioctl and fcntl white-listing the filedesc structure was
heavly modified.
- The audit subsystem, kdump and procstat tools were updated to
recognize new syscalls.
- Capability rights were revised and eventhough I tried hard to provide
backward API and ABI compatibility there are some incompatible changes
that are described in detail below:
CAP_CREATE old behaviour:
- Allow for openat(2)+O_CREAT.
- Allow for linkat(2).
- Allow for symlinkat(2).
CAP_CREATE new behaviour:
- Allow for openat(2)+O_CREAT.
Added CAP_LINKAT:
- Allow for linkat(2). ABI: Reuses CAP_RMDIR bit.
- Allow to be target for renameat(2).
Added CAP_SYMLINKAT:
- Allow for symlinkat(2).
Removed CAP_DELETE. Old behaviour:
- Allow for unlinkat(2) when removing non-directory object.
- Allow to be source for renameat(2).
Removed CAP_RMDIR. Old behaviour:
- Allow for unlinkat(2) when removing directory.
Added CAP_RENAMEAT:
- Required for source directory for the renameat(2) syscall.
Added CAP_UNLINKAT (effectively it replaces CAP_DELETE and CAP_RMDIR):
- Allow for unlinkat(2) on any object.
- Required if target of renameat(2) exists and will be removed by this
call.
Removed CAP_MAPEXEC.
CAP_MMAP old behaviour:
- Allow for mmap(2) with any combination of PROT_NONE, PROT_READ and
PROT_WRITE.
CAP_MMAP new behaviour:
- Allow for mmap(2)+PROT_NONE.
Added CAP_MMAP_R:
- Allow for mmap(PROT_READ).
Added CAP_MMAP_W:
- Allow for mmap(PROT_WRITE).
Added CAP_MMAP_X:
- Allow for mmap(PROT_EXEC).
Added CAP_MMAP_RW:
- Allow for mmap(PROT_READ | PROT_WRITE).
Added CAP_MMAP_RX:
- Allow for mmap(PROT_READ | PROT_EXEC).
Added CAP_MMAP_WX:
- Allow for mmap(PROT_WRITE | PROT_EXEC).
Added CAP_MMAP_RWX:
- Allow for mmap(PROT_READ | PROT_WRITE | PROT_EXEC).
Renamed CAP_MKDIR to CAP_MKDIRAT.
Renamed CAP_MKFIFO to CAP_MKFIFOAT.
Renamed CAP_MKNODE to CAP_MKNODEAT.
CAP_READ old behaviour:
- Allow pread(2).
- Disallow read(2), readv(2) (if there is no CAP_SEEK).
CAP_READ new behaviour:
- Allow read(2), readv(2).
- Disallow pread(2) (CAP_SEEK was also required).
CAP_WRITE old behaviour:
- Allow pwrite(2).
- Disallow write(2), writev(2) (if there is no CAP_SEEK).
CAP_WRITE new behaviour:
- Allow write(2), writev(2).
- Disallow pwrite(2) (CAP_SEEK was also required).
Added convinient defines:
#define CAP_PREAD (CAP_SEEK | CAP_READ)
#define CAP_PWRITE (CAP_SEEK | CAP_WRITE)
#define CAP_MMAP_R (CAP_MMAP | CAP_SEEK | CAP_READ)
#define CAP_MMAP_W (CAP_MMAP | CAP_SEEK | CAP_WRITE)
#define CAP_MMAP_X (CAP_MMAP | CAP_SEEK | 0x0000000000000008ULL)
#define CAP_MMAP_RW (CAP_MMAP_R | CAP_MMAP_W)
#define CAP_MMAP_RX (CAP_MMAP_R | CAP_MMAP_X)
#define CAP_MMAP_WX (CAP_MMAP_W | CAP_MMAP_X)
#define CAP_MMAP_RWX (CAP_MMAP_R | CAP_MMAP_W | CAP_MMAP_X)
#define CAP_RECV CAP_READ
#define CAP_SEND CAP_WRITE
#define CAP_SOCK_CLIENT \
(CAP_CONNECT | CAP_GETPEERNAME | CAP_GETSOCKNAME | CAP_GETSOCKOPT | \
CAP_PEELOFF | CAP_RECV | CAP_SEND | CAP_SETSOCKOPT | CAP_SHUTDOWN)
#define CAP_SOCK_SERVER \
(CAP_ACCEPT | CAP_BIND | CAP_GETPEERNAME | CAP_GETSOCKNAME | \
CAP_GETSOCKOPT | CAP_LISTEN | CAP_PEELOFF | CAP_RECV | CAP_SEND | \
CAP_SETSOCKOPT | CAP_SHUTDOWN)
Added defines for backward API compatibility:
#define CAP_MAPEXEC CAP_MMAP_X
#define CAP_DELETE CAP_UNLINKAT
#define CAP_MKDIR CAP_MKDIRAT
#define CAP_RMDIR CAP_UNLINKAT
#define CAP_MKFIFO CAP_MKFIFOAT
#define CAP_MKNOD CAP_MKNODAT
#define CAP_SOCK_ALL (CAP_SOCK_CLIENT | CAP_SOCK_SERVER)
Sponsored by: The FreeBSD Foundation
Reviewed by: Christoph Mallon <christoph.mallon@gmx.de>
Many aspects discussed with: rwatson, benl, jonathan
ABI compatibility discussed with: kib
allows userland application to use the following macros:
timespecclear, timespecisset, timespeccmp, timespecadd,
timespecsub;
timevalclear, timevalisset, timevalcmp.
MFC after: 1 month
fts(3) can run (albeit more slowly and imposing the {PATH_MAX} limit) when
the current directory cannot be opened. Therefore, do not make a failure to
open the current directory (for returning to it later in -exec) fatal.
If -execdir or -delete are used, the expectation is that fts(3) will use
chdir to avoid race conditions (except for -execdir with -L). Do not break
this expectation any more than it already is by still failing if the current
directory cannot be opened.
This is inefficient but ensures that -execdir ... {} + does not mix files
from different directories in one invocation; the command could not access
some files. Files from the same directory should really be handled in one
invocation but this is somewhat more complicated.
According to the README file [1] the 12u variant, unlike
the 12g variant, contains no copyleft code. It is therefore
convenient to keep using the original versioning scheme to
prevent confusions.
[1] http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/patch/README
Document the need for the setuid bit and how to set it.
Explain why it isn't set by default, and suggest simply adding users
to groups instead.
PR: docs/167741
MFC after: 3 weeks
Dont use/link ARCMT, StaticAnalyzer and Rewriter to clang when the user
specifies not to. Dont build ASTMatchers with Rewriter disabled and
StaticAnalyzer when it's disabled.
Without all those three, the clang binary shrinks (x86_64) from ~36MB
to ~32MB (unstripped).
To disable these clang components, and get a smaller clang binary built
and installed, set WITHOUT_CLANG_FULL in src.conf(5). During the
initial stages of buildworld, those extra components are already
disabled automatically, to save some build time.
MFC after: 1 week
- Remove $DragonFly$ tags as they are using git nowadays and VCS tags will
not help merging.
- Other changes to Copyright headers to make them consistent with other
source code, we intend to fork from this point.
Reviewed by: pfg
DragonflyBSD and install it as bsdpatch. WITH_BSD_PATCH makes it
default and installs GNU patch as gnupatch.
Submitted by: pfg
Obtained from: The DragonflyBSD Project
be used on the host system (and not installed on the device, if required). The
GPL'd one is still available if there are any devices that need it (make
universe passes with it, including kernels that use fdt, but there may be some
out-of-tree ones). WITH_GPL_DTC can be used to select the old one, for now.
Probably won't be MFC'd, but we'll remove the GPL'd version in head after the
new one has had a lot more testing and ship it in 10.0.
* -M <metalog> Log metadata in mtree format.
* -D <destdir> Log paths relative to <destdir>.
* -h <hash> Log digest of type <hash>.
* -T <tags> Specify which mtree tags to log.
* -l <linkflag> Create hard or symbolic links (allows logging).
* -U Install without root privileges (owner, group, mode,
and flags can be logged via -M
NOTE: In the interest of compatibility with NetBSD and because it is the
obvious letter, the nearly useless -M option (disable mmap) has been
repurposed.
Sponsored by: DARPA, AFRL
Obtained from: NetBSD
Reviewed by: bz
manpage. While here, exit early when there is nothing to do.
PR: 168415
Submitted by: Zhihao Yuan (initial version)
MFC after: 1 week
Approved by: kib (mentor)
group file to be used. This is useful for installing on systems where
a user or group does not currently exist.
Sponsored by: DARPA, AFRL
Obtained from: NetBSD
MFC after: 5 days
zero argument were supplied.
Add a regression test to catch this case as well.
PR: bin/174521
Submitted by: Daniel Shahaf <danielsh@elego.de> (pr)
Submitted by: Mark Johnston <markjdb@gmail.com> (initial patch)
Reviewed by: jilles
Approved by: cperciva (implicit)
MFC after: 3 weeks
The offset is already accounted for in xs->lastrcvd and doesn't
have to be subtracted again.
Reported by: Florian Smeets <flo@smeets.im>
Submitted by: Mateusz Guzik <mjguzik@gmail.com>
Tested by: Florian Smeets <flo@smeets.im>
MFC after: 1 week
Note that a preprocessor cannot output an empty file, since that
is interpreted as meaning there is no replacement, and the origi-
nal file is used. To avoid this, if LESSOPEN starts with two ver-
tical bars, the exit status of the script becomes meaningful. If
the exit status is zero, the output is considered to be replace-
ment text, even if it empty. If the exit status is nonzero, any
output is ignored and the original file is used. For compatibil-
ity with previous versions of less, if LESSOPEN starts with only
one vertical bar, the exit status of the preprocessor is ignored.
Use two pipe symbols for zless, so that zless'ing a compressed empty
file will give output rather than being interpreted as its compressed
form, which is typically a binary.
Thanks Mark Nudelman for pointing out this difference and the
suggested solution.
Reported by: Matthias Meyser <meyser xenet.de>
PR: bin/168839
MFC after: 2 weeks
Use whitespace (spaces and tabs) as the delimiter.
Consecutive spaces and tabs count as one single field
separator.
Reviewed by: swildner@dragonflybsd.org
Approved by: cperciva
Obtained from: DragonFlyBSD
MFC after: 1 week
cmdlengthdelta is the size of the header and we were using it to
allocate a buffer to store the command line. This would mean that
the cmdbuf could be too short. In practice this was never noticed unless
you usually run top -a. On a stock FreeBSD system you can see the
problem by running sendmail and then running top -a on a big terminal
window. In practice this doubles to size available to cmdbuf since the
header is around 65-68 bytes.
Reviewed by: adrian
userland via routing socket or sysctl. This eliminates the following
KAME-specific sin6_scope_id handling routine from each userland utility:
sin6.sin6_scope_id = ntohs(*(u_int16_t *)&sin6.sin6_addr.s6_addr[2]);
This behavior can be controlled by net.inet6.ip6.deembed_scopeid. This is
set to 1 by default (sin6_scope_id will be filled in the kernel).
Reviewed by: bz
o Report the instantaneous bandwidth instead of an average since the
beginning of the download.
o At the finish of the download report the average bandwidth and also
the total time it took instead of 00m00s.
Reviewed by: des
MFC after: 1 week
- Implement a function to ensure that all preempted threads have switched
back out at least once. Use this to make sure there are no stale
references to the old ktr_buf or the lock profiling buffers before
updating them.
Reviewed by: marius (sparc64 parts), attilio (earlier patch)
Sponsored by: EMC / Isilon Storage Division
Use more portable constructs in order to allow upstream adoption
Add per-file error messages
Reviewed by: jilles
Approved by: cperciva
MFC after: 1 week
Machines can stall out because mbufs are low, however sometimes we won't
see "requests denied", instead we see user land processes or kernel threads
blocking waiting for mbufs because they set M_WAIT. These consumers do not
see errors, only stalling.
Unfortunately until now, netstat did not export this information
so you could have experienced an mbuf shortage and have no way of
seeing it unless you happen to run netstat at the exact time of the
shortage and see "in use" = "max".
By exporting the number of times processes are blocked, we can
effectively see how often non-interrupt context threads are effectively
"denied".
MFC after: 2 weeks
found in openssh's contrib directory.
This version has more features and is better written.
I intend to submit this upstream as well.
Reviewed by: bapt
Reviewed by: des
Approved by: cperciva
MFC after: 1 week
current version of FreeBSD, this isn't guarenteed by the API. Custom
security modules, or future implementations of the setuid and setgid
may fail.
PR: bin/172289
PR: bin/172290
PR: bin/172291
Submittud by: Erik Cederstrand <erik@cederstrand.dk>
Discussed by: freebsd-security
Approved by: cperciva
MFC after: 1 week
current version of FreeBSD, this isn't guarenteed by the API.
Custom security modules, or future implementations of the setuid and
setgid may fail.
Submitted by: Erik Cederstrand
Approved by: cperciva
MFC after: 3 days
but committing it helps to get everyone on the same page and makes
sure we make progress.
Tinderbox breakages that are the result of this commit are entirely
the committer's fault -- in other words: buildworld testing on amd64
only.
Credits follow:
Submitted by: Garrett Cooper <yanegomi@gmail.com>
Sponsored by: Isilon Systems
Based on work by: keramida@
Thanks to: gnn@, mdf@, mlaier@, sjg@
Special thanks to: keramida@
In addition to adding missing `static' keywords:
- bin/dd: Pull in `extern.h' to guarantee consistency with source file.
- libexec/rpc.rusersd: Move shared globals into an extern.h.
- libexec/talkd: Move `debug' and `hostname' into extern.h.
- usr.bin/cksum: Put counters in extern.h, as they are used by ckdist/mtree.
- usr.bin/m4: Move `end_result' into extern.h.
- usr.sbin/services_mkdb: Move shared globals into an extern.h.
make) ended up being built with -DFORCE_MACHINE. This broke the lib32
built for amd64 & powerpc64.
This fix is comes with the next import of bmake, but is committed here
and now to minimize the exposure to the bug.
Submitted by: Simon Gerraty <sjg@juniper.net>
In addition to adding `static' where possible:
- bin/date: Move `retval' into extern.h to make it visible to date.c.
- bin/ed: Move globally used variables into ed.h.
- sbin/camcontrol: Move `verbose' into camcontrol.h and fix shadow warnings.
- usr.bin/calendar: Remove unneeded variables.
- usr.bin/chat: Make `line' local instead of global.
- usr.bin/elfdump: Comment out unneeded function.
- usr.bin/rlogin: Use _Noreturn instead of __dead2.
- usr.bin/tset: Pull `Ospeed' into extern.h.
- usr.sbin/mfiutil: Put global variables in mfiutil.h.
- usr.sbin/pkg: Remove unused `os_corres'.
- usr.sbin/quotaon, usr.sbin/repquota: Remove unused `qfname'.
GIANT from VFS. In addition, disconnect also netsmb, which is a base
requirement for SMBFS.
In the while SMBFS regular users can use FUSE interface and smbnetfs
port to work with their SMBFS partitions.
Also, there are ongoing efforts by vendor to support in-kernel smbfs,
so there are good chances that it will get relinked once properly locked.
This is not targeted for MFC.
GIANT from VFS. In addition, disconnect also netncp, which is a base
requirement for NWFS.
In the possibility of a future maintenance of the code and later
readd to the FreeBSD base, maybe we should think about a better location
for netncp. I'm not entirely sure the / top location is actually right,
however I will let network people to comment on that more specifically.
This is not targeted for MFC.
of FreeBSD's make by setting WITH_BMAKE. The WITH_BMAKE build makes it
easy for people to switch while working out the kinks -- think ports
tree here. The option will be removed in due time.
Submitted by: Simon Gerraty (sjg@juniper.net)
This is useful if you have been given some time for some event in some
format and you want your computer to do something to prepare for it.
Without having to do time arithmetic in a shellscript.
The syntax matches what the at(1) usually used on Linux supports.
This reduces code duplication and code size.
/usr/bin/printf is not affected.
Side effect: different error messages when certain builtins are passed
invalid options.
