freebsd-skq/lib/libc/tests
Kyle Evans 60c4ec806d jail: allow root to implicitly widen its cpuset to attach
The default behavior for attaching processes to jails is that the jail's
cpuset augments the attaching processes, so that it cannot be used to
escalate a user's ability to take advantage of more CPUs than the
administrator wanted them to.

This is problematic when root needs to manage jails that have disjoint
sets with whatever process is attaching, as this would otherwise result
in a deadlock. Therefore, if we did not have an appropriate common
subset of cpus/domains for our new policy, we now allow the process to
simply take on the jail set *if* it has the privilege to widen its mask
anyways.

With the new logic, root can still usefully cpuset a process that
attaches to a jail with the desire of maintaining the set it was given
pre-attachment while still retaining the ability to manage child jails
without jumping through hoops.

A test has been added to demonstrate the issue; cpuset of a process
down to just the first CPU and attempting to attach to a jail without
access to any of the same CPUs previously resulted in EDEADLK and now
results in taking on the jail's mask for privileged users.

PR:		253724
Reviewed by:	jamie (also discussed with)
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D28952
2021-03-01 12:38:31 -06:00
..
c063 Provide O_SEARCH 2020-02-02 16:34:57 +00:00
db DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
gen libc: tests: hook CPUSET(9) test up to the build 2020-12-31 12:26:01 -06:00
hash DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
iconv lib/libc/tests/iconv: raise WARNS to 6 2020-09-24 21:42:44 +00:00
inet DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
locale DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
net Fix filename to avoid skipping lib/libc/net/servent test. 2019-07-15 23:41:00 +00:00
nss libc/nss tests: Add regression tests for commit 55444c823e1f 2021-01-21 14:30:19 -05:00
regex build: provide a default WARNS for all in-tree builds 2020-09-18 17:17:46 +00:00
resolv libc/resolv: attempt to fix the test under WARNS=6 2020-09-09 02:42:21 +00:00
rpc DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
setjmp DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
ssp Rename NO_WERROR -> MK_WERROR=no 2021-01-07 09:31:03 +00:00
stdio AArch64: Don't set flush-subnormals-to-zero flag on startup 2021-03-01 14:27:30 +00:00
stdlib Remove remaining uses of ${COMPILER_FEATURES:Mc++11} 2021-01-19 21:37:36 +00:00
string Avoid copying too much from the input string. 2019-07-19 23:58:30 +00:00
sys jail: allow root to implicitly widen its cpuset to attach 2021-03-01 12:38:31 -06:00
termios DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
time DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
tls DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
tls_dso Update Makefile.depend files 2019-12-11 17:37:53 +00:00
ttyio DIRDEPS_BUILD: Update dependencies. 2017-10-31 00:07:04 +00:00
Makefile Connect libc/tests/time to the build, adding test cases for strptime() 2018-10-30 02:37:23 +00:00
Makefile.depend
Makefile.netbsd-tests