kernel - Add per-process capability-based restrictions* This new system allows userland to set capability restrictions which turns off numerous kernel features and root accesses. These restricti
kernel - Add per-process capability-based restrictions* This new system allows userland to set capability restrictions which turns off numerous kernel features and root accesses. These restrictions are inherited by sub-processes recursively. Once set, restrictions cannot be removed. Basic restrictions that mimic an unadorned jail can be enabled without creating a jail, but generally speaking real security also requires creating a chrooted filesystem topology, and a jail is still needed to really segregate processes from each other. If you do so, however, you can (for example) disable mount/umount and most global root-only features.* Add new system calls and a manual page for syscap_get(2) and syscap_set(2)* Add sys/caps.h* Add the "setcaps" userland utility and manual page.* Remove priv.9 and the priv_check infrastructure, replacing it with a newly designed caps infrastructure.* The intention is to add path restriction lists and similar features to improve jailess security in the near future, and to optimize the priv_check code.
show more ...
kernel: Cleanup <sys/uio.h> issues. The iovec_free() inline very complicates this header inclusion. The NULL check is not always seen from <sys/_null.h>. Luckily only three kernel sources needs
kernel: Cleanup <sys/uio.h> issues. The iovec_free() inline very complicates this header inclusion. The NULL check is not always seen from <sys/_null.h>. Luckily only three kernel sources needs it: kern_subr.c, sys_generic.c and uipc_syscalls.c. Also just a single dev/drm source makes use of 'struct uio'. * Include <sys/uio.h> explicitly first in drm_fops.c to avoid kfree() macro override in drm compat layer. * Use <sys/_uio.h> where only enums and struct uio is needed, but ensure that userland will not include it for possible later <sys/user.h> use. * Stop using <sys/vnode.h> as shortcut for uiomove*() prototypes. The uiomove*() family functions possibly transfer data across kernel/user space boundary. This header presence explicitly mark sources as such. * Prefer to add <sys/uio.h> after <sys/systm.h>, but before <sys/proc.h> and definitely before <sys/malloc.h> (except for 3 mentioned sources). This will allow to remove <sys/malloc.h> from <sys/uio.h> later on. * Adjust <sys/user.h> to use component headers instead of <sys/uio.h>. While there, use opportunity for a minimal whitespace cleanup. No functional differences observed in compiler intermediates.
kernel: Remove numerous #include <sys/thread2.h>.Most of them were added when we converted spl*() calls tocrit_enter()/crit_exit(), almost 14 years ago. We can nowremove a good chunk of them agai
kernel: Remove numerous #include <sys/thread2.h>.Most of them were added when we converted spl*() calls tocrit_enter()/crit_exit(), almost 14 years ago. We can nowremove a good chunk of them again for where crit_*() areno longer used.I had to adjust some files that were relying on thread2.hor headers that it includes coming in via other headersthat it was removed from.
kernel - Refactor tty_token, fix SMP performance issues* Remove most uses of tty_token in favor of per-tty tp->t_token. This is particularly important for removing bottlenecks related to PTYs,
kernel - Refactor tty_token, fix SMP performance issues* Remove most uses of tty_token in favor of per-tty tp->t_token. This is particularly important for removing bottlenecks related to PTYs, which are used all over the place. tty_token remains in a few places managing overall registration and global list manipulation.* tty structures are now required to be persistent. Implement a sepearate ttyinit() function. Continue to allow ttyregister() and ttyunregister() calls, but these no longer presume destruction of the structure.* Refactor ttymalloc() to take a **tty pointer and interlock allocations. Allocations are intended to be one-time. ttymalloc() only requires the tty_token for initial allocations.* Remove all critical section use that was combined with tty_token and tp->t_token. Leave only the tokens. The critical sections were hold-overs going all the way back to pre-SMP days.* syscons now gets its own token, vga_token. The ISA VGA code and the framebuffer code also now use this token instead of tty_token.* The keyboard subsystem now uses kbd_token instead of tty_token.* A few remaining serial-like devices (snp, nmdm) also get their own tokens, as well as use the now required tp->t_token.* Remove use of tty_token in the session management code. This fixes a niggling performance path since sessions almost universally go hand-in-hand with fork/exec/exit sequences. Instead we use the already-existing per-hash session token.
kernel: Include <sys/ttydefaults.h> where appropriate.This is in preparation for moving <sys/termios.h> to <termios.h>.
kernel: Remove the COMPAT_43 kernel option along with all related code.It is commented out in our default kernel config files for almost fiveyears now, since 9466f37df5258f3bc3d99ae43627a71c1c085e
kernel: Remove the COMPAT_43 kernel option along with all related code.It is commented out in our default kernel config files for almost fiveyears now, since 9466f37df5258f3bc3d99ae43627a71c1c085e7d.Approved-by: dillonDragonfly-bug: <https://bugs.dragonflybsd.org/issues/2946>
Remove advertising header from sys/Correct BSD License clause numbering from 1-2-4 to 1-2-3.Some less clear cases taken as it was done of FreeBSD.
kernel: Move semicolon from the definition of SYSINIT() to its invocations.This affected around 70 of our (more or less) 270 SYSINIT() calls.style(9) advocates the terminating semicolon to be sup
kernel: Move semicolon from the definition of SYSINIT() to its invocations.This affected around 70 of our (more or less) 270 SYSINIT() calls.style(9) advocates the terminating semicolon to be supplied by theinvocation too, because it can make life easier for editors and othersource code parsing programs.
kernel: Remove 'options COMPAT_SUNOS'.It was supposed to provide binary compatibility with SunOS 4.x for thesparc32 port of 4.4BSD.
kernel/nmdm: Comment variables which are only used in commented code.
kernel: Remove some unused variables in the rest of the kernel tree.
kernel: Use ${.TARGET} in module Makefiles.
kernel: Use NULL for pointers.
Remove useless .PATH targets from kernel module Makefiles.All these came in from FreeBSD which keeps their module Makefiles insys/modules (that is, separate from the source). We don't, so they are
Remove useless .PATH targets from kernel module Makefiles.All these came in from FreeBSD which keeps their module Makefiles insys/modules (that is, separate from the source). We don't, so they arenot needed.
kernel: Remove most definitions of CDEV_MAJOR.These are no longer needed since we have devfs.A few are left in because they are added to the order in SYSINIT()s.This needs further investigation.
MPSAFE - TTY & related drivers* Put kern/tty_* under the tty_token (and acquire the proc_token where needed).* MPSAFE all related drivers (users of kbdsw, linesw and vidsw) with the same tty_
MPSAFE - TTY & related drivers* Put kern/tty_* under the tty_token (and acquire the proc_token where needed).* MPSAFE all related drivers (users of kbdsw, linesw and vidsw) with the same tty_token.* NOTE: syscons.c and scvgarndr.c are not really under this new lock yet as some really strange hangs appear. Some are related to the cursor drawing (which stalls the machine if a token is held) and others are in some other syscons.c functions.
kernel - Remove D_KQFILTER flag* The D_KQFILTER flag is no longer used.
kernel - Remove kevent subsystem from under mplock* Create a global token for the kevent subsystem to operate under* Push klist insertion and removal into knote_insert()/knote_remove()* Rename
kernel - Remove kevent subsystem from under mplock* Create a global token for the kevent subsystem to operate under* Push klist insertion and removal into knote_insert()/knote_remove()* Rename struct selinfo to struct kqinfo
kernel - Tear out selwakeup()
kernel - Add missing KNOTE's* Place a KNOTE call anywhere there is currently a call to selwakeup.
kernel - Tear out device polling* Remove existing (now legacy) code that implements device polling, kq filters are now the "One True (and only) Way"* Add dummy write filters (always true) for d
kernel - Tear out device polling* Remove existing (now legacy) code that implements device polling, kq filters are now the "One True (and only) Way"* Add dummy write filters (always true) for devices: targ, vinum, snp, tw and apm
kernel - Add kq support to tty devices* This is all of the remaining tty devices missing kq support.* vcons, dcons, sysmouse, pts, rp
AMD64 - Refactor uio_resid and size_t assumptions.* uio_resid changed from int to size_t (size_t == unsigned long equivalent).* size_t assumptions in most kernel code has been refactored to opera
AMD64 - Refactor uio_resid and size_t assumptions.* uio_resid changed from int to size_t (size_t == unsigned long equivalent).* size_t assumptions in most kernel code has been refactored to operate in a 64 bit environment.* In addition, the 2G limitation for VM related system calls such as mmap() has been removed in 32 bit environments. Note however that because read() and write() return ssize_t, these functions are still limited to a 2G byte count in 32 bit environments.
DEVFS - remove dev_ops_add(), dev_ops_get(), and get_dev()
vrevoke/single-user - fix more revoke issues.* vrevoke() no longer clears vp->v_rdev. Doing so interferes with specfs's ability to call dev_dclose(). Fixing this will allow the regular close
vrevoke/single-user - fix more revoke issues.* vrevoke() no longer clears vp->v_rdev. Doing so interferes with specfs's ability to call dev_dclose(). Fixing this will allow the regular close of the vnode to close the underlying device. Since the revoke code detaches the vnode from any user-visible file descriptors the vnode will end up being closed the moment the last referenced to the detached fp goes away.* kill 1 no longer leaves the syscons in a state where both /dev/ttyv0 and /dev/console are marked open (due to the above bug). This state would cause the keyboard to stop working sometimes when dropping into single user.* Add dev_drevoke() and friends. This allows a device to do something when an attempt is made to revoke() the related vnode. TTY and PTY devices now attempt to break out of any ttysleep() operation (such as when processes are blocked in read()). This is advisory and if it fails to break a process out of a blocked condition that process will still detach after the blocked condition is resolved normally.
12