Age | Commit message (Collapse) | Author |
|
effectively use pledge(2) in some programs.
approval from many, thanks!
idea by & ok deraadt@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
OK benno@
|
|
Also simplify code.
|
|
|
|
|
|
Tweaked diff from brad@
manpage tweaks florian@ and jmc@
ok deraadt@ millert@
|
|
unveil for each unveil in the process at unveil() time, and refactoring the
handling of current directory and ISDOTDOT to be much more sensible.
Worked out at ns2k18 with guenther@.
ok deraadt@
|
|
ok guenther@ tb@ deraadt@
|
|
From Brad, tested by Miod, OK kettenis@
|
|
From Brad, OK mpi@ kettenis@
|
|
This brings it back in line with the macros.
via Paco A. and the FRRouting project.
ok deraadt@ visa@ guenther@ tb@
|
|
verified/ok tb
|
|
ok kettenis@
|
|
The C implementation of str{,r}chr are not linked to the build, because
assembly implementations are used, but change to code for easier reference.
At least the i386 and amd64 are checked and seem to do the correct thing.
Found thanks to the csh any/strchr change.
minor pointers and OK millert@
|
|
ok mpi@ jca@
|
|
more uniform; potential for confusion noticed by aalm@; OK jmc@.
|
|
|
|
|
|
librthread on armv7 as well
from brad ok visa@ kettenis@ mpi@
|
|
|
|
|
|
It replaces the existing pwcache.c functions user_from_uid(3) and
group_from_gid(3) with the pax equivalents. Adapted from NetBSD
(mycroft) changes from our own pax's cache.c. OK guenther@
|
|
of the pointer returned by getpw{ent,nam,uid}(). We unmap the
buffer each time to catch callers using a stale passwd struct
pointer. As a special case, we do not unmap the buffer if the
previous lookup was for the same name or uid. This special case
may be removed in the future. OK deraadt@
|
|
Not a strictly portable use of the interface and there are more suitable
interfaces for timeouts anyway.
ok schwarze millert
|
|
cases in kernel and libc.
ok deraadt@
|
|
ok beck jmc
|
|
|
|
unveil for relative operations) that I am working on in BUGS
|
|
|
|
|
|
the amount of modal verbs going on;
|
|
okay mestre@
|
|
OK millert@ deraadt@ and jmc@ who also gave me a cluebat stick
|
|
ok deraadt@
|
|
This brings unveil into the tree, disabled by default - Currently
this will return EPERM on all attempts to use it until we are
fully certain it is ready for people to start using, but this
now allows for others to do more tweaking and experimentation.
Still needs to send the unveil's across forks and execs before
fully enabling.
Many thanks to robert@ and deraadt@ for extensive testing.
ok deraadt@
|
|
The introduction of hw.smt means that logical CPUs can be disabled
after boot and prior to suspend/resume. If hw.smt=0 (the default),
there needs to be a way to count the number of hardware threads
available on the system at any given time.
So, import HW_NCPUONLINE/hw.ncpuonline from NetBSD and document it.
hw.ncpu becomes equal to the number of CPUs given to sched_init_cpu()
during boot, while hw.ncpuonline is equal to the number of CPUs available
to the scheduler in the cpuset "sched_all_cpus". Set_SC_NPROCESSORS_ONLN
equal to this new sysctl and keep _SC_NPROCESSORS_CONF equal to hw.ncpu.
This is preferable to adding a new sysctl to count the number of
configured CPUs and keeping hw.ncpu equal to the number of online
CPUs because such a change would break software in the ecosystem
that relies on HW_NCPU/hw.ncpu to measure CPU usage and the like.
Such software in base includes top(1), systat(1), and snmpd(8),
and perhaps others.
We don't need additional locking to count the cardinality of a cpuset
in this case because the only interfaces that can modify said cardinality
are sysctl(2) and ioctl(2), both of which are under the KERNEL_LOCK.
Software using HW_NCPU/hw.ncpu to determine optimal parallism will need
to be updated to use HW_NCPUONLINE/hw.ncpuonline. Until then, such software
may perform suboptimally. However, most changes will be similar to the
change included here for libcxx's std::thread:hardware_concurrency():
using HW_NCPUONLINE in lieu of HW_NCPU should be sufficient for determining
optimal parallelism for most software if the change to _SC_NPROCESSORS_ONLN
is insufficient.
Prompted by deraadt. Discussed at length with kettenis, deraadt, and sthen.
Lots of patch tweaks from kettenis.
ok kettenis, "proceed" deraadt
|
|
const promise when processing it in the regex engine.
Minor tweak and OK schwarze@
|
|
ENTRY is a trapsled. Fix a few functions which fall-through into an ENTRY
macro. amd64 binaries now are free of double+-nop sequences (except for one
assember nit in aes-586.pl). Previous changes by guenther got us here.
ok mortimer kettenis
|
|
ok deraadt
|
|
This lets other threads of the process modify the file descriptor
table even if the vn_open(9) call blocks.
The change has an effect on dup2(2) and dup3(2). If the new descriptor
is the same as the one reserved by an unfinished open(2), the system
call will fail with error EBUSY. The accept(2) system call already
behaves like this.
Issue pointed out by art@ via mpi@
Tested in a bulk build by ajacoutot@
OK mpi@
|
|
ok deraadt@
|
|
|