Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 8 Oct 2019 13:59:53 +0300
From:      Sergey Kandaurov <pluknet@freebsd.org>
To:        John Baldwin <jhb@FreeBSD.org>
Cc:        Ryan Stone <rysto32@gmail.com>, FreeBSD Current <freebsd-current@freebsd.org>
Subject:   Re: ktrace/kdump give incorrect message on unlinkat() failure due to capabilities
Message-ID:  <20191008105953.ktwgu4xgeydmry2c@MacBook-Air.local>
In-Reply-To: <cfbbaa8c-e5ac-1f02-4895-94e6a5368d66@FreeBSD.org>
References:  <CAFMmRNwLYUhf8YYr-Jpw3CrPj-sU6mg-5xMF-krTE-PpKxnPRA@mail.gmail.com> <20190925173338.lvlg4cstdjcwwbtm@MacBook-Air.local> <cfbbaa8c-e5ac-1f02-4895-94e6a5368d66@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Oct 07, 2019 at 09:48:16AM -0700, John Baldwin wrote:
> On 9/25/19 10:33 AM, Sergey Kandaurov wrote:
> > 
> > Index: lib/libsysdecode/mktables
> > ===================================================================
> > --- lib/libsysdecode/mktables	(revision 352685)
> > +++ lib/libsysdecode/mktables	(working copy)
> > @@ -157,7 +157,7 @@
> >  gen_table "sigcode"         "SI_[A-Z]+[[:space:]]+0(x[0-9abcdef]+)?"       "sys/signal.h"
> >  gen_table "umtxcvwaitflags" "CVWAIT_[A-Z_]+[[:space:]]+0x[0-9]+"           "sys/umtx.h"
> >  gen_table "umtxrwlockflags" "URWLOCK_PREFER_READER[[:space:]]+0x[0-9]+"    "sys/umtx.h"
> > -gen_table "caprights"       "CAP_[A-Z_]+[[:space:]]+CAPRIGHT\([0-9],[[:space:]]+0x[0-9]{16}ULL\)"   "sys/capsicum.h"
> > +gen_table "caprights"       "CAP_[A-Z_]+[[:space:]]+(CAPRIGHT|[()A-Z_|[:space:]]+CAP_LOOKUP)"   "sys/capsicum.h"
> >  gen_table "sctpprpolicy"    "SCTP_PR_SCTP_[A-Z_]+[[:space:]]+0x[0-9]+"     "netinet/sctp_uio.h" "SCTP_PR_SCTP_ALL"
> >  gen_table "cmsgtypesocket"  "SCM_[A-Z_]+[[:space:]]+0x[0-9]+"              "sys/socket.h"
> >  if [ -e "${include_dir}/x86/sysarch.h" ]; then
> 
> CAP_SEEK and CAP_MMAP_X might also be subject to this.  However, I'm not quite
> understanding the regex, or at least why the modified portion of the regex isn't
> something like this:
> 
> (CAPRIGHT\(|\(CAP_LOOKUP)

This won't match against CAP_LOOKUP on the right side, as in CAP_FSTATAT,
but since it is built from CAP_FSTAT and CAP_LOOKUP, it should be fine still.

> That is, you currently have [()A-Z_|[:space:]]+ for an expression that I think
> will only ever match a single '(' character.

All this sad magic is for preceding characters before CAP_LOOKUP,
such as in "(CAP_FSTAT | CAP_LOOKUP".  But seems it isn't needed.

> A more general form that might work for CAP_SEEK and CAP_MMAP_X might be
> to match on 'CAP_<foo> | 0x<constant)', so something like:
> 
> (CAPRIGHT\(|\([^)]*CAP_[A-Z_]+ \| 0x[0-9]+)

Given the above, it looks fine.



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20191008105953.ktwgu4xgeydmry2c>