mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-06 13:09:50 +00:00
Code Issues Releases Activity
c2ea794587
freebsd/usr.sbin
History
Mark Johnston 04e9edb544 Capsicumize rtsol(8) and rtsold(8). 
These programs parse ND6 Router Advertisement messages; rtsold(8) has
required an SA, SA-14:20.rtsold, for a bug in this code.  Thus, they
are good candidates for sandboxing.

The approach taken is to run the main executable in capability mode
and use Casper services to provide functionality that cannot be
implemented within the sandbox.  In particular, several custom services
were required.

- A Casper service is used to send Router Solicitation messages on a
  raw ICMP6 socket.  Initially I took the approach of creating a
  socket for each interface upon startup, and connect(2)ing it to
  the all-routers multicast group for the interface.  This permits
  the use of sendmsg(2) in capability mode, but only works if the
  interface's link is up when rtsol(d) starts.  So, instead, the
  rtsold.sendmsg service is used to transmit RS messages on behalf
  of the main process.  One could alternately define a service
  which simply creates and connects a socket for each destination
  address, and returns the socket to the sandboxed process.  However,
  to implement rtsold's -m option we also need to read the ND6 default
  router list, and this cannot be done in capability mode.
- rtsold may execute resolvconf(8) in response to RDNSS and DNSSL
  options in received RA messages.  A Casper service is used to
  fork and exec resolvconf(8), and to reap the child process.
- A service is used to determine whether a given interface's
  link-local address is useable (i.e., not duplicated or undergoing
  DAD).  This information is supplied by getifaddrs(3), which reads
  a sysctl not available in capability mode.  The SIOCGIFCONF socket
  ioctl provides equivalent information and can be used in capability
  mode, but I decided against it for now because of some limitations
  of that interface.

In addition to these new services, cap_syslog(3) is used to send
messages to syslogd.

Reviewed by:	oshogbo
Tested by:	bz (previous versions)
MFC after:	2 months
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D17572
2019-01-05 16:05:39 +00:00
..
ac various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
accton General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
acpi Amend the `-i batt' option description and explain that the battery 2018-12-27 08:48:54 +00:00
adduser various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
amd Move amd.map to usr.sbin/amd/amd/ 2018-09-18 00:32:10 +00:00
ancontrol spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
apm
apmd Move apmd.conf to CONFS in usr.sbin/apmd which simplifies this nicely. 2018-07-26 16:51:23 +00:00
arp Remove infrastructure for token-ring networks. 2018-03-28 23:33:26 +00:00
audit
auditd Move OpenBSM to CONFS 2018-08-11 13:23:09 +00:00
auditdistd
auditreduce
authpf
autofs There is no way of escaping literal $ signs in auto_master(5), which 2018-12-28 15:11:22 +00:00
bhyve Fix bhyve's NVMe Completion Queue entry values 2019-01-04 15:03:35 +00:00
bhyvectl style(9) remove unnecessary blank tabs. 2018-06-13 03:35:24 +00:00
bhyveload userboot: handle guest interpreter mismatches more intelligently 2018-09-01 02:23:45 +00:00
binmiscctl Improve the binmiscctl manual page 2018-07-20 22:50:21 +00:00
blacklistctl
blacklistd Move blacklistd.conf to usr.sbin/blacklistd/ 2018-07-31 16:39:38 +00:00
bluetooth Fix the install location of hcsecd.conf 2018-08-26 02:09:20 +00:00
boot0cfg Add a “skip_dsn” option to g_part's bootcode verb to prevent g_part_mbr 2018-11-27 14:58:19 +00:00
bootparamd
bsdconfig Remove iBCS2, part1: userspace 2018-12-19 21:56:54 +00:00
bsdinstall Use the --activate efibootmgr(8) flag when creating entries in bootconfig 2018-12-31 00:26:35 +00:00
bsnmpd Extended pf(4) ioctl interface and pfctl(8) to allow bandwidths of 2018-08-22 19:38:48 +00:00
btxld Explicitly ignore return value from remove. We wouldn't do anything 2017-12-28 05:33:19 +00:00
camdd Make timespecadd(3) and friends public 2018-07-30 15:46:40 +00:00
cdcontrol
chkgrp various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
chown Handle overflow of uid or gid in arguments for chown 2018-09-26 18:40:57 +00:00
chroot General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
ckdist various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
clear_locks various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
config config(8): Remove all instances of an option when opting out 2018-12-22 06:08:06 +00:00
cpucontrol cpucontrol(8): De-duplicate common update logic 2018-11-14 00:21:49 +00:00
crashinfo Support compressed crash dumps in crashinfo(8). 2018-07-23 18:08:56 +00:00
cron Move etc/crontab to usr.sbin/cron/cron/ 2018-09-06 14:55:54 +00:00
crunch send-pr: wave goodbye 2018-08-19 07:12:35 +00:00
ctladm Fix passing wrong variables to nvlist_destroy() after r333446. 2018-12-21 17:22:15 +00:00
ctld iscsi: simplify the capsicumization 2018-11-30 19:40:16 +00:00
cxgbetool cxgbetool(8): Add a subaction (tcbrss <n>) that can be used with "pass" 2018-10-27 05:26:09 +00:00
daemon Cross-reference nohup(1) and daemon(8). 2018-11-09 13:47:06 +00:00
dconschat spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
devctl Create devctl freeze/thaw. 2018-08-23 05:05:47 +00:00
devinfo devinfo_init() returns an errno, but doesn't set errno, so the error 2018-05-30 15:08:59 +00:00
diskinfo Sanity check media size and sector counts to ensure that we don't 2018-01-06 12:34:03 +00:00
dumpcis Fix typo & build 2018-01-05 08:29:32 +00:00
editmap
edquota General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
eeprom various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
efibootmgr Update the efibootmgr(8) man page to document changes to options. 2019-01-01 04:57:46 +00:00
efidp Set dp to NULL when we free it, and tree a NULL dp as an error 2018-01-05 07:09:24 +00:00
efivar Fix pointer arithmetic botch. 2018-10-26 23:44:39 +00:00
etcupdate Cross-reference mergemaster(8) & etcupdate(8). 2018-11-27 10:31:29 +00:00
extattr various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
extattrctl various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
fdcontrol Tag 'a' case as one we're intentionally falling through to 2018-01-05 07:28:48 +00:00
fdformat fdformat is a sysadmin command and thus its man page should be in 2017-12-05 05:02:46 +00:00
fdread various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
fdwrite SPDX: use the Beerware identifier. 2017-11-30 20:33:45 +00:00
fifolog various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
flowctl various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
fmtree
freebsd-update freebsd-update: add a progress report for the "fetching files..." 2018-10-31 17:37:54 +00:00
fstyp Normally when an attempt is made to mount a UFS/FFS filesystem whose 2018-12-06 00:09:39 +00:00
ftp-proxy
fwcontrol Don't close fd twice. This line should have been deleted in r327279. 2018-01-05 05:34:20 +00:00
getfmac various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
getpmac various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
gpioctl gpioctl.8: Fix man page section 2018-06-06 18:52:33 +00:00
gssd various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
gstat - Add CSV output to gstat via -C flag. 2018-08-21 11:22:49 +00:00
hyperv
i2c various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
ifmcstat bits is never null when we call ot. Add an assert to that effect and 2018-01-05 07:28:58 +00:00
inetd Move inetd.conf to usr.sbin/inetd/ 2018-08-12 13:29:40 +00:00
iostat iostat: update man page for r277566 2018-08-20 13:42:22 +00:00
iovctl
ip6addrctl General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
ipfwpcap Buildfix for GCC after r334277. 2018-05-28 09:41:44 +00:00
iscsid iscsi: simplify the capsicumization 2018-11-30 19:40:16 +00:00
jail In hardened systems, where the security.bsd.unprivileged_proc_debug sysctl 2018-11-27 17:51:50 +00:00
jexec various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
jls various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
kbdcontrol various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
kbdmap various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
keyserv
kgmon Free zbuf when kflag is true too. 2017-12-28 05:34:04 +00:00
kgzip various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
kldxref kldxref: use appropriate Elf_Off type for offsets 2018-11-09 15:02:53 +00:00
lastlogin A single comma was missing to separate the "see also" items in 2018-10-20 17:22:04 +00:00
lpr Move hosts.lpd and printcap to usr.sbin/lpr/lpd/ 2018-09-20 09:21:05 +00:00
lptcontrol various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
mailstats
mailwrapper Revert r326844 2018-01-02 16:50:57 +00:00
makefs makefs: use FreeBSD brelse function signature 2018-07-26 13:33:10 +00:00
makemap
manctl spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
memcontrol various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
mergemaster Cross-reference mergemaster(8) & etcupdate(8). 2018-11-27 10:31:29 +00:00
mfiutil Make mfiutil show progress print out the elapsed time estimate in a 2018-10-13 02:21:23 +00:00
mixer
mld6query Fix mld6query(8) and add a new -g option 2018-05-11 19:37:18 +00:00
mlx5tool Check that the address is specified in mlx5tool(8). 2018-03-08 15:28:13 +00:00
mlxcontrol various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
mount_smbfs
mountd Reduce number of DNS queries in mountd. 2018-12-06 18:21:48 +00:00
moused Remove mse(4) from tree 2018-10-22 02:34:10 +00:00
mpsutil mpsutil: correct style 2018-05-23 09:46:21 +00:00
mptable various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
mptutil Delete copypasta 2018-02-23 17:20:53 +00:00
mtest mtest: build with WARNS=3 2018-05-19 20:57:22 +00:00
nandsim various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
nandtool nandtool: Add missing mode for open() with O_CREAT 2017-12-26 16:20:38 +00:00
ndiscvt Don't leak outfile. Free it before we return from bincvt. 2017-12-28 05:34:14 +00:00
ndp Update the "flag" for draft-ietf-6man-ipv6only-flag. 2018-11-03 18:03:24 +00:00
newsyslog Fix age_old_log() after r337468. 2018-11-29 16:49:56 +00:00
nfscbd
nfsd nfsd: Factorize code 2018-11-04 06:39:01 +00:00
nfsdumpstate
nfsrevoke
nfsuserd Add missing endpwent() and endgrent() calls to nfsuserd(8). 2018-08-28 15:18:14 +00:00
ngctl Add blank line after each item in "ngctl ls -l" 2018-10-26 19:16:17 +00:00
nghook
nmtree
nologin
nscd Style cleanup. 2018-11-27 09:41:47 +00:00
ntp Fix typo introduced in r340439 - s/ETN/ETC/ 2018-11-14 18:38:27 +00:00
nvram
ofwdump
pc-sysinstall share and pc-sysinstall: adoption of SPDX licensing ID tags. 2017-11-27 15:28:26 +00:00
pciconf Require write access when mmapping BAR. 2018-08-03 18:35:20 +00:00
periodic periodic/weekly/340.noid: do not use sysrc(8) that depends 2018-12-15 23:20:08 +00:00
pkg Move pkg/FreeBSD.conf to usr.sbin/pkg/ 2018-07-31 16:42:03 +00:00
pmc Fix build with GCC 8.1. 2018-10-01 16:16:05 +00:00
pmcannotate Teach pmcannotate about $TMPDIR and _PATH_TMP 2018-05-18 14:14:04 +00:00
pmccontrol restore pmccontrol -L behavior on x86 2018-09-24 19:06:09 +00:00
pmcstat pmc: convert native to jsonl and track TSC value of samples 2018-06-07 02:03:22 +00:00
pmcstudy
pnfsdscopymr Fix the err() arguments for a nfssvc(8) failure. 2018-08-08 20:30:12 +00:00
pnfsdsfile Document the new "-m" command line option for pnfsdsfile(8). 2018-07-01 17:51:52 +00:00
pnfsdskill Document the "-f" option added to pnfsdskill(8) by r336176. 2018-07-10 18:44:44 +00:00
pnpinfo
portsnap Now that the portsnap buildbox is generating the raw bits for INDEX-13, 2018-10-25 08:05:53 +00:00
powerd powerd: correct ifdef check for ppc 2018-06-27 01:28:09 +00:00
ppp Make ppp(8) buildable. 2018-09-19 07:09:55 +00:00
pppctl pppctl88) Avoid strcpy() copies on overlapping string. 2018-01-29 14:23:44 +00:00
praliases
praudit praudit(1): add tests 2018-06-17 17:31:16 +00:00
prometheus_sysctl_exporter
pstat General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
pw pw: fix the checks in boolean_str() after r326738. Add related test 2018-10-21 14:23:56 +00:00
pwd_mkdb pwd_mkdb: retire -B and -L endianness options 2018-10-21 00:48:38 +00:00
pwm pwm(8): Add percentage value support for duty cycle 2018-12-14 18:38:10 +00:00
quot Normally when an attempt is made to mount a UFS/FFS filesystem whose 2018-12-06 00:09:39 +00:00
quotaon General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
rarpd SPDX: mostly fixes to previous changes. 2017-12-13 16:13:17 +00:00
repquota General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
rip6query General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
rmt Fix missing files in METALOG with -DNO_ROOT 2018-06-29 21:15:17 +00:00
route6d Use the right variable when updating interface routes. 2018-08-08 20:15:40 +00:00
rpc.lockd userland: Fix several typos and minor errors 2017-12-27 03:23:01 +00:00
rpc.statd spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
rpc.umntall various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
rpc.yppasswdd spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
rpc.ypupdated spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
rpc.ypxfrd spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
rpcbind Plug a possible memory leak. 2018-03-19 05:49:26 +00:00
rrenumd General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
rtadvctl various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
rtadvd Update the "flag" for draft-ietf-6man-ipv6only-flag. 2018-11-03 18:03:24 +00:00
rtprio various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
rtsold Capsicumize rtsol(8) and rtsold(8). 2019-01-05 16:05:39 +00:00
rwhod capsicum: use a new capsicum helpers in tools 2018-11-04 19:24:49 +00:00
sa various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
sendmail
service Use "$@" instead of $* to cope with parameters that have spaces in 2018-06-13 06:11:04 +00:00
services_mkdb Add MPLS LSP-echo (RFC8029, March 2017) port. 2018-09-06 18:34:11 +00:00
sesutil
setfib General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
setfmac various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
setpmac various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
smbmsg various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
snapinfo various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
spi Add an example for displaying the manufacturer and size info from a 2018-06-23 23:08:25 +00:00
spkrtest various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
spray spray: fix the spelling in an output string 2018-03-05 16:13:29 +00:00
syslogd Remove trailing slash in pathname so that valid METALOG is created in the 2018-08-25 20:19:16 +00:00
sysrc sysrc(8): Send error message to stderr (not stdout) 2018-07-16 18:53:17 +00:00
tcpdchk
tcpdmatch
tcpdrop Use uintptr_t alone when assigning to kvaddr_t variables. 2018-07-10 13:03:06 +00:00
tcpdump
tests
traceroute various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
traceroute6 Fix in the documentation that the default hop limit is not 30, but 2018-05-02 19:36:46 +00:00
trpt trpt(8): Clean up build hack to detect ancient compiler 2018-02-16 20:46:44 +00:00
tzsetup In read_zones(), check if the file name actually fit in the buffer 2018-08-09 02:47:22 +00:00
uathload various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
uefisign Fix alignment issue in uefisign 2018-12-19 22:47:37 +00:00
ugidfw various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
uhsoctl Use correct type for IOCTL request argument. 2018-11-02 22:23:25 +00:00
unbound Check that /etc/resolv.conf exists before trying to read it. 2018-11-27 09:46:01 +00:00
usbconfig Clean up the EXAMPLES section of usbconfig(8). This removes parts that 2018-04-29 10:45:09 +00:00
usbdump various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
utx various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
vidcontrol vidcontrol(1): Fix a typo in the description of -f 2018-10-20 16:59:43 +00:00
vigr
vipw General further adoption of SPDX licensing ID tags. 2017-11-20 19:49:47 +00:00
wake various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
watch Revert r327005 - SPDX tags for license similar to BSD-2-Clause. 2017-12-20 20:25:28 +00:00
watchdogd various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
wlandebug libifconfig: multiple feature additions 2018-02-23 03:11:43 +00:00
wpa Set default ciphers. 2018-12-12 05:18:53 +00:00
yp_mkdb spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
ypbind various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
ypldap
yppoll various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
yppush spdx: initial adoption of licensing ID tags. 2017-11-18 14:26:50 +00:00
ypserv su_data: correct macro expansion. 2018-02-08 14:53:34 +00:00
ypset various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
zic
zonectl
zzz
Makefile Remove, the now very outdated, timed. 2018-12-15 21:34:40 +00:00
Makefile.amd64 Remove obsolete asf(8) 2018-06-15 17:44:21 +00:00
Makefile.arm
Makefile.arm64
Makefile.i386 Remove obsolete asf(8) 2018-06-15 17:44:21 +00:00
Makefile.inc
Makefile.mips
Makefile.powerpc
Makefile.riscv Build ofwdump on riscv. 2018-07-24 20:20:17 +00:00
Makefile.sparc64