Add tests for 4 syscalls in "file-close" audit class

[aniketp]

Summary

The following changes introduce a new test-program file-close , which introduces tests for the
following 4 system calls in both success and failure mode:

• munmap
• close
• closefrom
• revoke

Note: These are the only system calls in "cl" audit class

Test Plan

Execute make && make install from test/sys/audit.
Execute kyua test from /usr/tests/sys/audit. All testcases should succeed.

[asomers]

What about closefrom(2)? And I thought that "fc" was "file-close"? If so, you need a different name for "cl".

tests/sys/audit/file-close.c

64 ↗

(On Diff #43259)

No magic numbers please

118 ↗

(On Diff #43259)

Another magic number

160 ↗

(On Diff #43259)

Why would you ever malloc a single byte?

[aniketp]

Allocate enough size to ptyname and replace hardcoded size for
ptyname with sizeof(ptyname)

[asomers]

tests/sys/audit/file-close.c

68 ↗

(On Diff #43271)

What's the significance of 4 * pagesize? Would 1 byte not work?

160 ↗

(On Diff #43271)

No magic numbers please.

[aniketp]

Update the file descriptor limit as INT_MAX in closefrom(2)

[asomers]

tests/sys/audit/file-close.c

118 ↗

(On Diff #43272)

Backslashes aren't needed to break a line in C.

183 ↗

(On Diff #43272)

There's still no programmatic guarantee that this buffer will be large enough. Unfortunately , there's no way to achieve that guarantee using openpty(2). That's why people use posix_openpt + ptsname instead. However, if you'll read the source, you'll see that there's an undocumented maximum length that openpty will write. The exact value is left as an exercise to the reader.

[aniketp]

Use posix_openpt(2) and ptsname(3) instead of openpty(3)
Also, remove the extraneous backslash in one of the snprintf statement

[asomers]

The build fails on 32-bit architectures. Looks like a classic printf format specifier failure.

/home/asomers/freebsd/base/head/tests/sys/audit/file-close.c:115:50: error: format specifies type 'unsigned long' but the argument has type 'ino_t' (aka 'unsigned long long') [-Werror,-Wformat]
                sizeof(extregex), "close.*%lu.*return,succes", statbuff.st_ino);
                                          ~~~                  ^~~~~~~~~~~~~~~
                                          %llu
1 error generated.

[aniketp]

Update the format specifier for st_ino as llu from lu

[asomers]

Well, that fixed the build on i386, but broke it on amd64. Try again.

[aniketp]

Would it be fine to check the presence of PID in the audit regex instead of "Inode number"?
Also, is this a viable fix?
snprintf(extregex, sizeof(extregex), "close.*%ld.*return,succes", (long int)statbuff.st_ino);

I tried testing this using -m32 as a "CFLAG" but instead got a loader error: /usr/bin/ld: cannot find -lprivateatf-c

[asomers]

In D15650#330770, @aniketp wrote:

Would it be fine to check the presence of PID in the audit regex instead of "Inode number"?
Also, is this a viable fix?
snprintf(extregex, sizeof(extregex), "close.*%ld.*return,succes", (long int)statbuff.st_ino);

Close. The usual approach in situations like this is to cast the variable to an intmax_t and print it with %jd.

I tried testing this using -m32 as a "CFLAG" but instead got a loader error: /usr/bin/ld: cannot find -lprivateatf-c

That's because you haven't built the 32-bit ATF libraries. The easiest way to do it is to build an entire i386 world. From /usr/src, do ARCH=i386 TARGET_ARCH=i386 make -jwhatever buildworld. You can even build for other architectures, like sparc64 or riscv.

[aniketp]

Update the typecasting of statbuff.st_ino to intmax_t and format specfier as %jd to support all architectures.