From nobody Mon Dec 16 14:45:20 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YBjR46YNVz5hWQL; Mon, 16 Dec 2024 14:45:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YBjR43ND5z4cfV; Mon, 16 Dec 2024 14:45:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1734360320; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kLHqemCUUASqo/nca+0wBiYEVCPhtqIsrgNUuF1keac=; b=s3h7dLZXbomtA+QujXiZPeFsSpNw08u5fu0AclM/koO5ji2iQiebODO8BuVYAPsldalgJT hOFFfP5Gi5Sm9i8LUzD95LdzdQdVsPrslN/7wrRbpOAM8+OfY/hcMVgXQYvJW2D+51PCRo Z4v6eisHHUkTKXs+CMPTr1N16V1I0nJabeslvceUPfgK/GklWtkox3ijYTwK6q+zsicPi6 ZbQSnat4rG0gGABXLl3XnDlmO64ikqb3CnhsvSpBQ1C2iJyVUMHxViaeBwcfWB7NbOx4PH eHQiX49FFVymCk9q5TLSu7ToapHGkcQD0LbLKZASxVtwAwUjW6kAaTV0ev6gNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1734360320; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kLHqemCUUASqo/nca+0wBiYEVCPhtqIsrgNUuF1keac=; b=utIwA4DoM4DYw5dcZPmbiBPtY/SjNNKDqppBWUjp5k+ZrC6S13n8VKXxNeHyrg02XG1Vzz rLbwRnHV9lJFdXykrx+0DhMOGTXqhPxzIJsXMBI8QQF97tJ4nhV/wbLZPa6+Np5HXNHWHp OqEGidKo/tAQzdQ1QeovM0edMpQap/2cHz+KPbhcqMQo2Z3OFE4nI32KWo2R7XPwhDCojP 1NFWkwEdjL/ZZaRSJrT7rnEhvtLfVns7sxHaiAfrHgcpCk0HWrN/CdAPKohWb9Q5yzMDCI jsn7G9r5SRZmQccYk1RF5nBr9r01NjLmQLDub+6o3ZT7hjKGF63XGTWGQMJ2ZA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1734360320; a=rsa-sha256; cv=none; b=lIdxvkbvJl6pJes7NwBY1tZJ64UsNmBzKRqW3FKkFTd1K593WkEZZFYg18ME5AEWXk9y7z QftCpeUsHStDzfMfLhs02dR2bXpZPaydbqmeLi/eh5LKn2LrlvoCprn0cAsf7Oz/+pAgpp P83foe/d4v0lHSQcqbYSKGErn78zD3/LRx9tdHWAA29oKTbbATGEsdpmg9+kXK+B+NuiTc mjClU2KeaaJJQz3v50+BYrhG+EnUWKelZWFsuPGrcUNA7YPPsTTpc0sNYSw2WQq+UOeWbf yEEtEKIdYWkheLUdHaDVQxVigCSLUH3W7zPfXj/sl2ey8rGoAW9vnOylKQdRLA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YBjR42zsDzxnH; Mon, 16 Dec 2024 14:45:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4BGEjKJK051692; Mon, 16 Dec 2024 14:45:20 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4BGEjKH9051689; Mon, 16 Dec 2024 14:45:20 GMT (envelope-from git) Date: Mon, 16 Dec 2024 14:45:20 GMT Message-Id: <202412161445.4BGEjKH9051689@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Olivier Certner Subject: git: 09290c3a0c82 - main - cred: Hide internal flag CRED_FLAG_CAPMODE List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 09290c3a0c82524138973b14f393379edf733753 Auto-Submitted: auto-generated The branch main has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=09290c3a0c82524138973b14f393379edf733753 commit 09290c3a0c82524138973b14f393379edf733753 Author: Olivier Certner AuthorDate: 2024-07-16 16:07:40 +0000 Commit: Olivier Certner CommitDate: 2024-12-16 14:42:29 +0000 cred: Hide internal flag CRED_FLAG_CAPMODE This flag is used in field 'cr_flags', which is never directly visible outside the kernel. That field is however exported through 'struct kinfo_proc' objects (field 'ki_cr_flags'), either from the kernel via sysctls or from libkvm, and is supposed to contain exported flags prefixed with KI_CRF_ (currently, KI_CRF_CAPABILITY_MODE and KI_CRF_GRP_OVERFLOW, this second one being a purely userland one signaling overflow of 'ki_groups'). Make sure that KI_CRF_CAPABILITY_MODE is the flag actually exported and tested by userland programs, and hide the internal CRED_FLAG_CAPMODE. As both flags are currently defined to the same value, this doesn't change the KBI, but of course does change the KPI. A code search via GitHub and Google fortunately doesn't reveal any outside uses for CRED_FLAG_CAPMODE. While here, move assignment of 'ki_uid' to a more logical place in kvm_proclist(), and definition of XU_NGROUPS as well in 'sys/ucred.h' (no functional/interface changes intended). Reviewed by: mhorne Approved by: markj (mentor) MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46909 --- bin/ps/print.c | 2 +- lib/libkvm/kvm_proc.c | 6 ++++-- sys/sys/ucred.h | 12 ++++++------ usr.bin/procstat/procstat_cred.c | 2 +- 4 files changed, 12 insertions(+), 10 deletions(-) diff --git a/bin/ps/print.c b/bin/ps/print.c index 59631fb66a10..13ef646ea462 100644 --- a/bin/ps/print.c +++ b/bin/ps/print.c @@ -265,7 +265,7 @@ state(KINFO *k, VARENT *ve __unused) *cp++ = 'V'; if ((flag & P_SYSTEM) || k->ki_p->ki_lock > 0) *cp++ = 'L'; - if ((k->ki_p->ki_cr_flags & CRED_FLAG_CAPMODE) != 0) + if ((k->ki_p->ki_cr_flags & KI_CRF_CAPABILITY_MODE) != 0) *cp++ = 'C'; if (k->ki_p->ki_kiflag & KI_SLEADER) *cp++ = 's'; diff --git a/lib/libkvm/kvm_proc.c b/lib/libkvm/kvm_proc.c index 6d2879f34d8f..b2b7c6ecce56 100644 --- a/lib/libkvm/kvm_proc.c +++ b/lib/libkvm/kvm_proc.c @@ -142,11 +142,14 @@ kvm_proclist(kvm_t *kd, int what, int arg, struct proc *p, if (proc.p_state == PRS_NEW) continue; if (KREAD(kd, (u_long)proc.p_ucred, &ucred) == 0) { + kp->ki_uid = ucred.cr_uid; kp->ki_ruid = ucred.cr_ruid; kp->ki_svuid = ucred.cr_svuid; kp->ki_rgid = ucred.cr_rgid; kp->ki_svgid = ucred.cr_svgid; - kp->ki_cr_flags = ucred.cr_flags; + kp->ki_cr_flags = 0; + if (ucred.cr_flags & CRED_FLAG_CAPMODE) + kp->ki_cr_flags |= KI_CRF_CAPABILITY_MODE; if (ucred.cr_ngroups > KI_NGROUPS) { kp->ki_ngroups = KI_NGROUPS; kp->ki_cr_flags |= KI_CRF_GRP_OVERFLOW; @@ -154,7 +157,6 @@ kvm_proclist(kvm_t *kd, int what, int arg, struct proc *p, kp->ki_ngroups = ucred.cr_ngroups; kvm_read(kd, (u_long)ucred.cr_groups, kp->ki_groups, kp->ki_ngroups * sizeof(gid_t)); - kp->ki_uid = ucred.cr_uid; if (ucred.cr_prison != NULL) { if (KREAD(kd, (u_long)ucred.cr_prison, &pr)) { _kvm_err(kd, kd->program, diff --git a/sys/sys/ucred.h b/sys/sys/ucred.h index 75156cca09a5..25dff911241b 100644 --- a/sys/sys/ucred.h +++ b/sys/sys/ucred.h @@ -38,11 +38,14 @@ #endif #include +#if defined(_KERNEL) || defined(_WANT_UCRED) struct loginclass; -#define XU_NGROUPS 16 +/* + * Flags for cr_flags. + */ +#define CRED_FLAG_CAPMODE 0x00000001 /* In capability mode. */ -#if defined(_KERNEL) || defined(_WANT_UCRED) /* * Number of groups inlined in 'struct ucred'. It must stay reasonably low as * it is also used by some functions to allocate an array of this size on the @@ -96,10 +99,7 @@ struct ucred { #define FSCRED ((struct ucred *)-1) /* filesystem credential */ #endif /* _KERNEL || _WANT_UCRED */ -/* - * Flags for cr_flags. - */ -#define CRED_FLAG_CAPMODE 0x00000001 /* In capability mode. */ +#define XU_NGROUPS 16 /* * This is the external representation of struct ucred. diff --git a/usr.bin/procstat/procstat_cred.c b/usr.bin/procstat/procstat_cred.c index 7f1efeab9d4c..decb7b9ca7df 100644 --- a/usr.bin/procstat/procstat_cred.c +++ b/usr.bin/procstat/procstat_cred.c @@ -62,7 +62,7 @@ procstat_cred(struct procstat *procstat, struct kinfo_proc *kipp) xo_emit("{:rgid/%5d} ", kipp->ki_rgid); xo_emit("{:svgid/%5d} ", kipp->ki_svgid); xo_emit("{:umask/%5s} ", get_umask(procstat, kipp)); - xo_emit("{:cr_flags/%s}", kipp->ki_cr_flags & CRED_FLAG_CAPMODE ? + xo_emit("{:cr_flags/%s}", kipp->ki_cr_flags & KI_CRF_CAPABILITY_MODE ? "C" : "-"); xo_emit("{P: }");