Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.
Still need to add real targets under targets/ to build packages.
Differential Revision: D2796
Reviewed by: brooks imp
1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
where it never would work anyhow, such as csu or loader. This suggests
there may be better ways of adding support to the tree. Many of these
cases can be fixed such that -fPIE will work but there is really no
reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
really building libraries but have been using bsd.prog.mk because the code
is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
been needed.
We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.
Reported by: kib
variants. This allows usable file system images (i.e. those with both a
shell and an editor) to be created with only one copy of the curses library.
Exp-run: antoine
PR: 189842
Discussed with: bapt
Sponsored by: DARPA, AFRL
This is currently an opt-in build flag. Once ASLR support is ready and stable
it should changed to opt-out and be enabled by default along with ASLR.
Each application Makefile uses opt-out to ensure that ASLR will be enabled by
default in new directories when the system is compiled with PIE/ASLR. [2]
Mark known build failures as NO_PIE for now.
The only known runtime failure was rtld.
[1] http://www.bsdcan.org/2014/schedule/events/452.en.html
Submitted by: Shawn Webb <lattera@gmail.com>
Discussed between: des@ and Shawn Webb [2]
and finish the job. ncurses is now the only Makefile in the tree that
uses it since it wasn't a simple mechanical change, and will be
addressed in a future commit.
available (closefrom() was added to FreeBSD in 8.0-release).
The selection is made at compile-time, as I still compile a
FreeBSD-based version of lpr&friends on other platforms.
While testing I out that (at least on my system) lpd has been
closing 11095 fd's, when there are only 6 fd's open. The old
code took 120 times more clocktime than calling closefrom().
(although that was still less than 2/1000-ths of a second!)
Reviewed by: jilles
MFC after: 2 weeks
Mark variables static where possible and place the uid/euid variables in
lp.h, so that we can compile-time enforce that these variables have the
same type.
current version of FreeBSD, this isn't guarenteed by the API. Custom
security modules, or future implementations of the setuid and setgid
may fail.
PR: bin/172289
PR: bin/172290
PR: bin/172291
Submittud by: Erik Cederstrand <erik@cederstrand.dk>
Discussed by: freebsd-security
Approved by: cperciva
MFC after: 1 week
arraysz could get initialized to zero on ZFS because ZFS reports
directory sizes differently compared to UFS.
PR: bin/169493
Tested by: swills
MFC after: 2 weeks
but odd permissions resulted in a security alert from 110.neggrpperm
PR: kern/165533
Submitted by: Anton Shterenlikht <mexas@bristol.ac.uk>
Submitted by: J B <jb.1234abcd@gmail.com>
Approved by: cperciva
MFC after: 1 week
Introduce dirfd() libc exported symbol replacing macro with same name,
preserve _dirfd() macro for internal use.
Replace dirp->dd_fd with dirfd() call. Avoid using dirfd as variable
name to prevent shadowing global symbol.
Sponsored by: Google Summer Of Code 2011
the queue is not 'lpc stop'-ed. In that situation `lpq' will
not display the status message to the user, and the operator
may think the queue is already stopped when it is not.
MFC after: 3 weeks
int (*compar)(const struct dirent **, const struct dirent **)
The current code defines sortq() to accept two void *, then cast them
to const struct dirent **. Because the code does not really need this
cast, we can eliminate the casts by changing the function prototype
to match scandir(3) expectation.
MFC after: 1 month
the username-for-accounting field (P), not the username-for-headerpage (L).
These are usually the same value, except that control files do not have
the username-for-headerpage field if the user has requested no header page.
- Also rename the cji_username field to cji_headruser, to make it clear that
the value should only be used for the header page. (aka banner page)
MFC after: 3 weeks
st_ino larger than 2**31.
From the PR:
Printing from a ZFS filesystem using 'lp' fails and returns an
email reporting "Your printer job was not printed because it was
not linked to the original file".
In order to protect against files being switched when files
are printed using 'lp' or 'lpr -s', the st_dev and st_ino
values for the original file are saved by lpr and verified
by lpd before the file is printed. Unfortunately, lpr prints
both values using '%d' (although both fields are unsigned)
and lpd(8) assumes a string of decimal digits.
ZFS (at least) generates st_dev values greater than 2^31-1,
resulting in negative values being printed - which lpd cannot
parse, leading it to report that the file has been switched.
A similar problem would occur with large inode numbers.
How-To-Repeat:
Find a file with either st_dev or st_ino greater than 2^31-1
(stat(1) will report both numbers) and print it with 'lpq -s'.
This should generate an email reporting that the file could
not be printed because it was not linked to the original file
PR: bin/151567
Submitted by: Peter Jeremy <Peter.Jeremy@alcatel-lucent.com>
MFC after: 1 week
print-jobs which have last-modification times that are in the future.
This shouldn't happen, of course, but it can. And when it did happen,
the previous check could cause completely-spooled jobs to sit in the
queue for 20 minutes per job. The new code waits until the last-modify
time is not changing, instead of making decisions based on the specific
value of last-modify.
MFC after: 2 weeks
