summaryrefslogtreecommitdiff
path: root/sys/kern/kern_sig.c
AgeCommit message (Collapse)Author
2019-10-06Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.Bob Beck
sweep tree to correct NDIINT op and flags ahead of time. document the requirement. This allows KERNELPATH to be used to bypass unveil for crash dumps with nosuidcoredump=2 or 3 ok visa@ deraadt@ florian@
2019-10-03sysctl global nosuidcoredump was being inspected twice inside coredump(),Theo de Raadt
with a sleep between. Reorganize the code for a single check. ok anton beck florian mpi
2019-08-07avoid large MAXPATHLEN object on the stack in coredump(), by allocatingTheo de Raadt
it from the pool. ok bluhm visa
2019-07-10Stop sleeping at PUSER.Martin Pieuchot
This allows to enforce that sleeping priorities will now always be < PUSER. ok visa@, ratchov@
2019-06-21Make resource limit access MP-safe. So far, the copy-on-write sharingVisa Hankala
of resource limit structs has been done between processes. By applying copy-on-write also between threads, threads can read rlimits in a nearly lock-free manner. Inspired by code in DragonFly BSD and FreeBSD. OK mpi@, agreement from jmatthew@ and anton@
2019-05-13When killing a process, the signal is handled by any thread thatAlexander Bluhm
does not block the signal. If all threads block the signal, we delivered it to the main thread. This does not conform to POSIX. If any thread unblocks the signal, it should be delivered immediately to this thread. Mark such signals pending at the process instead of a single thread. Then any thread can handle it later. OK kettenis@ guenther@
2019-05-01add a KERNEL_ASSERT_LOCKED() to ptsignalDavid Gwynne
it obviously needs to be called with the kernel lock held, so it makes sense to check that so we can unlock more code without introducing bugs that shoot us in the face in the indeterminate future. csignal is basically a wrapper around ptsignal, so calls to that without the kernel lock should be caught by this too. discussed with mpi@ on bugs@
2019-02-19open the coredump file non-blocking. cheloha found it blocks with a fifo.Ted Unangst
ok cheloha deraadt
2019-01-23Sprinkle a pinch of timerisvalid/timespecisvalid over the rest of sys/kerncheloha
2018-12-17Remove unused function gsignal().Visa Hankala
OK deraadt@ anton@
2018-11-12Add a mechanism for managing asynchronous IO signal registrations.Visa Hankala
It centralizes IO signal privilege checking and makes possible to revoke a registration when the target process or process group is deleted. Adapted from FreeBSD. OK kettenis@ mpi@ guenther@
2018-08-03wrap long linesTheo de Raadt
2018-07-18Revert the change that delivers process signals to any threads. AsAlexander Bluhm
side effect pending signals specifically sent to the main thread were handled by other threads. This made gcj in textproc/pdftk port build stall. Noticed and tested by espie@.
2018-07-11If no thread can immediately handle a signal, which has been sentAlexander Bluhm
to the process, it is made pending at the main thread. There it could hang forever. So also check the main thread for signal delivery. This workaround fixes hung tests in posixtestsuite. The proper solution would be to split pending signals for process and threads. input visa@; OK guenther@
2018-07-10Move from sendsig() to its callers the initsiginfo() calls andPhilip Guenther
instead of passing sendsig() the code+type+val, pass a siginfo_t* to copy from. Eliminate the indirection through struct emul for sendsig(); we no longer have a SunOS4-compat version of sendsig() ok deraadt@
2018-04-28Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is alwaysVisa Hankala
curproc that does the locking or unlocking, so the proc parameter is pointless and can be dropped. OK mpi@, deraadt@
2018-04-12Implement MAP_STACK option for mmap(). Synchronous faults (pagefault andTheo de Raadt
syscall) confirm the stack register points at MAP_STACK memory, otherwise SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified to create a MAP_STACK sub-region which satisfies alignment requirements. Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the contents of the region -- there is no mprotect() equivalent operation, so there is no MAP_STACK-adding gadget. This opportunistic software-emulation of a stack protection bit makes stack-pivot operations during ROPchain fragile (kind of like removing a tool from the toolbox). original discussion with tedu, uvm work by stefan, testing by mortimer ok kettenis
2018-03-27Exclude SIGKILL from ptrace(2) interception.Martin Pieuchot
This can lead to a deadlock where the parent waits infinitely for the traced process. Original problem reported by tb@ and worked around by visa@ for release by not calling CURSIG() twice in userret(). ok tb@, visa@
2018-03-24Avoid calling issignal() twice on signal delivery in order notVisa Hankala
to generate more than one ptrace(2) event. Do that by checking pending signals first without altering any state. If there is an unmasked signal ready for delivery, acquire the kernel lock and redo the checks in issignal(). This prevents gdb from blocking on exit when it attempts to kill an attached process, issue reported by tb@. OK mpi@, deraadt@
2018-02-26Fix a TOCTOU race that causes signals to be delivered more than once.Martin Pieuchot
The race is only triggerable if one of the threads of a multi-threaded program is in the middle of a NOLOCK syscall when a signal is received. The problem is that `ps_sigact' is shared between threads so its access should be serialized. In the case of SA_RESETHAND, the handler is reset when a signal is delivered, so delivering the signal twice would put the process in an "impossible" state where some threads were stopped and some were waiting for the others to die. Serialize signal checking & processing with the KERNEL_LOCK() for now, and introduce postsig_done() gypped from FreeBSD, to make sure the lock is held when resetting the handler. Bug report from espie@, ok visa@
2018-02-19Remove almost unused `flags' argument of suser().Martin Pieuchot
The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
2017-12-30Don't pull in <sys/file.h> just to get fcntl.hPhilip Guenther
ok deraadt@ krw@
2017-11-27Fix comment typoPhilip Guenther
2017-06-08ASLR, W^X, and guard pages trigger processor traps that result inAlexander Bluhm
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible in lastcomm(1). This also works if a programm tries to hide them with a signal handler. Manual kill -SEGV does not generate false positives. OK deraadt@
2017-04-20Add a port of witness(4) lock validation tool from FreeBSD.Visa Hankala
Go-ahead from kettenis@, guenther@, deraadt@
2017-04-14Avoid some false positives with cppcheck. No binary change.Alexander Bluhm
OK jsg@
2017-04-13Provide mips64 with kernel-facing TCB_{GET,SET} macros that store itPhilip Guenther
in struct mdproc. With that, all archs have those and the __HAVE_MD_TCB macro can be unifdef'ed as always defined. ok kettenis@ visa@ jsing@
2017-01-24Rename pfind(9) into tfind(9) to reflect that it deals with threads.Martin Pieuchot
While here document prfind(9. with and ok guenther@
2017-01-21p_comm is the process's command and isn't per thread, so move it fromPhilip Guenther
struct proc to struct process. ok deraadt@ kettenis@
2016-10-05Display/test/use the process PID, not the thread's TID, in a few places.Philip Guenther
ok mpi@ mikeb@
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-09-04Remove sys_o58_kill since OpenBSD 6.0 has been tagged/released.Joel Sing
ok deraadt@
2016-08-25pool_setiplDavid Gwynne
ok kettenis@
2016-07-14Prevent silly states via knotes on pids > 2^32 and on nonexistent signals.Philip Guenther
ok tedu@
2016-07-06fix several places where calculating ticks could overflow.Ted Unangst
it's not enough to assign to an unsigned type because if the arithmetic overflows the compiler may decide to do anything. so change all the long long casts to uint64_t so that we start with the right type. reported by Tim Newsham of NCC. ok deraadt
2016-06-27Repair kill(2) on zombie processes.Jeremie Courreges-Anglas
kill(2) is supposed to find zombie processes, this probably got broken when the process reaper was introduced. As a temporary(tm) workaround, walk the list of zombie processes if we can't find the target pid in the main process list. Problem with zsh initially reported by Geoff Wozniak on misc@, analysis done by naddy@. ok kettenis@ tedu@
2016-06-27Restore the sys_o58_kill system call.Joel Sing
By keeping both the new (sys_kill/sys_thrkill) and old (sys_o58_kill) system calls for the OpenBSD 6.0 release, code that uses either of these mechanisms will work on both of the supported OpenBSD releases. This provides a clean transition for runtimes that make direct system calls (namely the Go programming language). This requires a minimal amount of non-intrusive code and does not block development progress within OpenBSD. ok deraadt@ guenther@
2016-06-11if the timeout rounds to zero, make it one tick, otherwise we sleepTed Unangst
forever. noticed by Davin McCall. while here, if the timeout actually is zero, return appropriate error. ok guenther.
2016-05-31sys_o58_kill is no longer needed for compat.Theo de Raadt
ok guenther sthen
2016-03-29Use a macro to check if a thread has a sibling.Martin Pieuchot
Note that without locking a thread cannot claim that it is part of a multi-threaded process using this macro. Suggested by miod@, ok guenther@
2016-03-26add newline on the end of the failure messageBob Beck
ok deraadt@
2016-03-19Remove the unused flags argument from VOP_UNLOCK().natano
torture tested on amd64, i386 and macppc ok beck mpi stefan "the change looks right" deraadt
2016-03-09Correct some comments and definitions, from Michal Mazurek.Martin Pieuchot
2016-01-09drop "abort" promise, and make it the default behaviour.Sebastien Marie
The current code has already setted it by default since 1.74 any pledge failure tries to make a coredump (default rules for coredump still applies: so setuid binaries don't create them locally). ok deraadt@
2015-12-05remove stale lint annotationsTed Unangst
2015-11-10Split the intra-thread functionality from kill(2) into its own syscallPhilip Guenther
thrkill(2), rolling the kill(2) syscall number with the ABI change to avoid breaking binaries during during the transition. thrkill(2) includes a 'tcb' argument that eliminates the need for locking in pthread_kill() and simplifies pthread_cancel(). Switch __stack_smash_handler() to use thrkill(2) and explicitly unblock SIGABRT. Minor bump to both libc and libpthread: make sure you install a new kernel! ok semarie@
2015-11-02move the pledgenote annotation from `struct proc' to `struct nameidata'Sebastien Marie
pledgenote is used for annotate the policy for a namei context. So make it tracking the nameidata. It is expected for the caller to explicitly define the policy. It is a kernel bug to not do so. ok deraadt@
2015-11-01refactor pledge_*_check and pledge_fail functionsSebastien Marie
- rename _check function without suffix: a "pledge" function called from anywhere is a "check" function. - makes pledge_fail call the responsability to the _check function. remove it from caller. - make proper use of (potential) returned error of _check() functions. - adds pledge_kill() and pledge_protexec() with and OK deraadt@
2015-10-25Fold "malloc" into "stdio" and -- recognizing that no program so far hasTheo de Raadt
used less than "stdio" -- include all the "self" operations. Instead of different defines, use regular PLEDGE_* in the "p_pledgenote" variable (which indicates the operation subtype a system call is performing). Many checks before easier to understand. p_pledgenote can often be passed directly to ktrace, so that kdump says: 15565 test CALL pledge(0xa9a3f804c51,0) 15565 test STRU pledge request="stdio" 15565 test RET pledge 0 15565 test CALL open(0xa9a3f804c57,0x2<O_RDWR>) 15565 test NAMI "/tmp/testfile" 15565 test PLDG open, "wpath", errno 1 Operation not permitted with help from semarie, ok guenther
2015-10-10pid 0 also implies self, so allow that for the pledge case. Found inTheo de Raadt
a refactoring being done for the bc/dc relationship with otto.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-30 07:26:15 +0000