pkgbase: fix caroot packaging and add post-install script

[kevans]

Summary

The original intention for caroot was to be packaged separately, perhaps so that users can have a more/less conservative upgrade policy for this separated from the rest of base.

secure/caroot/Makefile doesn't have anything interesting to package, but its subdirectories might. Move the PACKAGE= to Makefile.inc so both blacklisted and trusted get packaged consistently into the correct one rather than the default -utilities. Also tag the directories for package=caroot, as they could also be empty; blacklisted is empty by default, but trusted is not.

Add a post-install script to do certctl rehash, along with a note should we eventually come up with a way to detect that files have been added or removed that requires a rehash.

head/etc/mtree/BSD.usr.dist

  *      s - see sleepq_switch(), sleeping_on_old_rtc(), and sleep(9)
  *      t - thread lock
  *      u - process stat lock
  *      w - process timer lock
  *      x - created at fork, only changes during single threading in exec
  *      y - created at first aio, doesn't change until exit or exec at which
  *          point we are single-threaded and only curthread changes it
  *      z - zombie threads lock
+ *      R - process rt-racct lock
  *
  * If the locking key specifies two identifiers (for example, p_pptr) then
  * either lock is sufficient for read access, but both locks must be held
  * for write access.
  */
 struct cpuset;
 struct filecaps;
 struct filemon;
#define td_startzero td_flags
         struct rusage        td_ru;                /* (t) rusage information. */
         struct rusage_ext td_rux;        /* (t) Internal rusage information. */
         uint64_t        td_incruntime;  /* (t) Cpu ticks to transfer to proc. */
         uint64_t        td_runtime;     /* (t) How many cpu ticks we've run. */
         u_int           td_pticks;      /* (t) Statclock hits for profiling */
         u_int           td_sticks;      /* (t) Statclock hits in system mode. */
         u_int           td_iticks;      /* (t) Statclock hits in intr mode. */
         u_int           td_uticks;      /* (t) Statclock hits in user mode. */
+        uint64_t        td_ltruntime;   /* (R) Still unprocessed cpu ticks */
+        uint64_t        td_rtpersec;    /* (R) Avg cpu ticks per second */
+        int             td_rtlastticks; /* (R) Last recalc hardclock tick */
+        int             td_pad1;        /* XXX avoid realigning all below */
         int             td_intrval;     /* (t) Return value for sleepq. */
         sigset_t        td_oldsigmask;  /* (k) Saved mask from pre sigpause. */
         volatile u_int        td_generation;        /* (k) For detection of preemption */
         stack_t         td_sigstk;      /* (k) Stack ptr and on-stack flag. */
         int             td_xsig;        /* (c) Signal for ptrace */
         u_long          td_profil_addr; /* (k) Temporary addr until AST. */
         u_int           td_profil_ticks; /* (k) Temporary ticks until AST. */
         char                td_name[MAXCOMLEN + 1];        /* (*) Thread name. */

 
 /*
  * Process structure.
  */
 struct proc {
         LIST_ENTRY(proc) p_list;        /* (d) List of all processes. */
         TAILQ_HEAD(, thread) p_threads;        /* (c) all threads. */
         struct mtx      p_slock;        /* process spin lock */
         struct ucred        *p_ucred;        /* (c) Process owner's identity. */
         struct filedesc        *p_fd;                /* (b) Open files. */
         struct filedesc_to_leader *p_fdtol; /* (b) Tracking node */
         struct pwddesc        *p_pd;                /* (b) Cwd, chroot, jail, umask */
         struct pstats        *p_stats;        /* (b) Accounting/statistics (CPU). */
         struct plimit        *p_limit;        /* (c) Resource limits. */
         struct callout        p_limco;        /* (c) Limit callout handle */
         struct sigacts        *p_sigacts;        /* (x) Signal actions, state (CPU). */
 
struct proc {
         LIST_HEAD(, proc) p_reaplist;        /* (e) List of my descendants
                                                (if I am reaper). */
         LIST_ENTRY(proc) p_reapsibling;        /* (e) List of siblings - descendants of
                                                the same reaper. */
         struct mtx        p_mtx;                /* (n) Lock for this struct. */
         struct mtx        p_statmtx;        /* Lock for the stats */
         struct mtx        p_itimmtx;        /* Lock for the virt/prof timers */
         struct mtx        p_profmtx;        /* Lock for the profiling */
+        struct mtx        p_rtmtx;        /* Lock for the realtime ucred-racct access */
         struct ksiginfo *p_ksi;        /* Locked by parent proc lock */
         sigqueue_t      p_sigqueue;     /* (c) Sigs not delivered to a td. */
 #define p_siglist       p_sigqueue.sq_signals
         pid_t           p_oppid;        /* (c + e) Real parent pid. */
 
 /* The following fields are all zeroed upon creation in fork. */
 #define p_startzero     p_vmspace
         struct vmspace        *p_vmspace;        /* (b) Address space. */

 
 #define PROC_ITIMLOCK(p)        mtx_lock_spin(&(p)->p_itimmtx)
 #define PROC_ITIMUNLOCK(p)      mtx_unlock_spin(&(p)->p_itimmtx)
 #define PROC_ITIMLOCK_ASSERT(p, type)   mtx_assert(&(p)->p_itimmtx, (type))
 
 #define PROC_PROFLOCK(p)        mtx_lock_spin(&(p)->p_profmtx)
 #define PROC_PROFUNLOCK(p)      mtx_unlock_spin(&(p)->p_profmtx)
 #define PROC_PROFLOCK_ASSERT(p, type)   mtx_assert(&(p)->p_profmtx, (type))
+
+#define PROC_RTLOCK(p)          mtx_lock_spin(&(p)->p_rtmtx)
+#define PROC_RTUNLOCK(p)        mtx_unlock_spin(&(p)->p_rtmtx)
+#define PROC_RTLOCK_ASSERT(p, type)     mtx_assert(&(p)->p_rtmtx, (type))
 
 /* These flags are kept in p_flag. */
 #define P_ADVLOCK       0x00000001      /* Process may hold a POSIX advisory
                                            lock. */
 #define P_CONTROLT      0x00000002      /* Has a controlling terminal. */
 #define P_KPROC         0x00000004      /* Kernel process. */
 #define P_UNUSED3       0x00000008      /* --available-- */
 #define P_PPWAIT        0x00000010      /* Parent is waiting for child to

head/release/packages/caroot.ucl

  *      s - see sleepq_switch(), sleeping_on_old_rtc(), and sleep(9)
  *      t - thread lock
  *      u - process stat lock
  *      w - process timer lock
  *      x - created at fork, only changes during single threading in exec
  *      y - created at first aio, doesn't change until exit or exec at which
  *          point we are single-threaded and only curthread changes it
  *      z - zombie threads lock
+ *      R - process rt-racct lock
  *
  * If the locking key specifies two identifiers (for example, p_pptr) then
  * either lock is sufficient for read access, but both locks must be held
  * for write access.
  */
 struct cpuset;
 struct filecaps;
 struct filemon;
#define td_startzero td_flags
         struct rusage        td_ru;                /* (t) rusage information. */
         struct rusage_ext td_rux;        /* (t) Internal rusage information. */
         uint64_t        td_incruntime;  /* (t) Cpu ticks to transfer to proc. */
         uint64_t        td_runtime;     /* (t) How many cpu ticks we've run. */
         u_int           td_pticks;      /* (t) Statclock hits for profiling */
         u_int           td_sticks;      /* (t) Statclock hits in system mode. */
         u_int           td_iticks;      /* (t) Statclock hits in intr mode. */
         u_int           td_uticks;      /* (t) Statclock hits in user mode. */
+        uint64_t        td_ltruntime;   /* (R) Still unprocessed cpu ticks */
+        uint64_t        td_rtpersec;    /* (R) Avg cpu ticks per second */
+        int             td_rtlastticks; /* (R) Last recalc hardclock tick */
+        int             td_pad1;        /* XXX avoid realigning all below */
         int             td_intrval;     /* (t) Return value for sleepq. */
         sigset_t        td_oldsigmask;  /* (k) Saved mask from pre sigpause. */
         volatile u_int        td_generation;        /* (k) For detection of preemption */
         stack_t         td_sigstk;      /* (k) Stack ptr and on-stack flag. */
         int             td_xsig;        /* (c) Signal for ptrace */
         u_long          td_profil_addr; /* (k) Temporary addr until AST. */
         u_int           td_profil_ticks; /* (k) Temporary ticks until AST. */
         char                td_name[MAXCOMLEN + 1];        /* (*) Thread name. */

 
 /*
  * Process structure.
  */
 struct proc {
         LIST_ENTRY(proc) p_list;        /* (d) List of all processes. */
         TAILQ_HEAD(, thread) p_threads;        /* (c) all threads. */
         struct mtx      p_slock;        /* process spin lock */
         struct ucred        *p_ucred;        /* (c) Process owner's identity. */
         struct filedesc        *p_fd;                /* (b) Open files. */
         struct filedesc_to_leader *p_fdtol; /* (b) Tracking node */
         struct pwddesc        *p_pd;                /* (b) Cwd, chroot, jail, umask */
         struct pstats        *p_stats;        /* (b) Accounting/statistics (CPU). */
         struct plimit        *p_limit;        /* (c) Resource limits. */
         struct callout        p_limco;        /* (c) Limit callout handle */
         struct sigacts        *p_sigacts;        /* (x) Signal actions, state (CPU). */
 
struct proc {
         LIST_HEAD(, proc) p_reaplist;        /* (e) List of my descendants
                                                (if I am reaper). */
         LIST_ENTRY(proc) p_reapsibling;        /* (e) List of siblings - descendants of
                                                the same reaper. */
         struct mtx        p_mtx;                /* (n) Lock for this struct. */
         struct mtx        p_statmtx;        /* Lock for the stats */
         struct mtx        p_itimmtx;        /* Lock for the virt/prof timers */
         struct mtx        p_profmtx;        /* Lock for the profiling */
+        struct mtx        p_rtmtx;        /* Lock for the realtime ucred-racct access */
         struct ksiginfo *p_ksi;        /* Locked by parent proc lock */
         sigqueue_t      p_sigqueue;     /* (c) Sigs not delivered to a td. */
 #define p_siglist       p_sigqueue.sq_signals
         pid_t           p_oppid;        /* (c + e) Real parent pid. */
 
 /* The following fields are all zeroed upon creation in fork. */
 #define p_startzero     p_vmspace
         struct vmspace        *p_vmspace;        /* (b) Address space. */

 
 #define PROC_ITIMLOCK(p)        mtx_lock_spin(&(p)->p_itimmtx)
 #define PROC_ITIMUNLOCK(p)      mtx_unlock_spin(&(p)->p_itimmtx)
 #define PROC_ITIMLOCK_ASSERT(p, type)   mtx_assert(&(p)->p_itimmtx, (type))
 
 #define PROC_PROFLOCK(p)        mtx_lock_spin(&(p)->p_profmtx)
 #define PROC_PROFUNLOCK(p)      mtx_unlock_spin(&(p)->p_profmtx)
 #define PROC_PROFLOCK_ASSERT(p, type)   mtx_assert(&(p)->p_profmtx, (type))
+
+#define PROC_RTLOCK(p)          mtx_lock_spin(&(p)->p_rtmtx)
+#define PROC_RTUNLOCK(p)        mtx_unlock_spin(&(p)->p_rtmtx)
+#define PROC_RTLOCK_ASSERT(p, type)     mtx_assert(&(p)->p_rtmtx, (type))
 
 /* These flags are kept in p_flag. */
 #define P_ADVLOCK       0x00000001      /* Process may hold a POSIX advisory
                                            lock. */
 #define P_CONTROLT      0x00000002      /* Has a controlling terminal. */
 #define P_KPROC         0x00000004      /* Kernel process. */
 #define P_UNUSED3       0x00000008      /* --available-- */
 #define P_PPWAIT        0x00000010      /* Parent is waiting for child to

head/release/packages/generate-ucl.sh

  *      s - see sleepq_switch(), sleeping_on_old_rtc(), and sleep(9)
  *      t - thread lock
  *      u - process stat lock
  *      w - process timer lock
  *      x - created at fork, only changes during single threading in exec
  *      y - created at first aio, doesn't change until exit or exec at which
  *          point we are single-threaded and only curthread changes it
  *      z - zombie threads lock
+ *      R - process rt-racct lock
  *
  * If the locking key specifies two identifiers (for example, p_pptr) then
  * either lock is sufficient for read access, but both locks must be held
  * for write access.
  */
 struct cpuset;
 struct filecaps;
 struct filemon;
#define td_startzero td_flags
         struct rusage        td_ru;                /* (t) rusage information. */
         struct rusage_ext td_rux;        /* (t) Internal rusage information. */
         uint64_t        td_incruntime;  /* (t) Cpu ticks to transfer to proc. */
         uint64_t        td_runtime;     /* (t) How many cpu ticks we've run. */
         u_int           td_pticks;      /* (t) Statclock hits for profiling */
         u_int           td_sticks;      /* (t) Statclock hits in system mode. */
         u_int           td_iticks;      /* (t) Statclock hits in intr mode. */
         u_int           td_uticks;      /* (t) Statclock hits in user mode. */
+        uint64_t        td_ltruntime;   /* (R) Still unprocessed cpu ticks */
+        uint64_t        td_rtpersec;    /* (R) Avg cpu ticks per second */
+        int             td_rtlastticks; /* (R) Last recalc hardclock tick */
+        int             td_pad1;        /* XXX avoid realigning all below */
         int             td_intrval;     /* (t) Return value for sleepq. */
         sigset_t        td_oldsigmask;  /* (k) Saved mask from pre sigpause. */
         volatile u_int        td_generation;        /* (k) For detection of preemption */
         stack_t         td_sigstk;      /* (k) Stack ptr and on-stack flag. */
         int             td_xsig;        /* (c) Signal for ptrace */
         u_long          td_profil_addr; /* (k) Temporary addr until AST. */
         u_int           td_profil_ticks; /* (k) Temporary ticks until AST. */
         char                td_name[MAXCOMLEN + 1];        /* (*) Thread name. */

 
 /*
  * Process structure.
  */
 struct proc {
         LIST_ENTRY(proc) p_list;        /* (d) List of all processes. */
         TAILQ_HEAD(, thread) p_threads;        /* (c) all threads. */
         struct mtx      p_slock;        /* process spin lock */
         struct ucred        *p_ucred;        /* (c) Process owner's identity. */
         struct filedesc        *p_fd;                /* (b) Open files. */
         struct filedesc_to_leader *p_fdtol; /* (b) Tracking node */
         struct pwddesc        *p_pd;                /* (b) Cwd, chroot, jail, umask */
         struct pstats        *p_stats;        /* (b) Accounting/statistics (CPU). */
         struct plimit        *p_limit;        /* (c) Resource limits. */
         struct callout        p_limco;        /* (c) Limit callout handle */
         struct sigacts        *p_sigacts;        /* (x) Signal actions, state (CPU). */
 
struct proc {
         LIST_HEAD(, proc) p_reaplist;        /* (e) List of my descendants
                                                (if I am reaper). */
         LIST_ENTRY(proc) p_reapsibling;        /* (e) List of siblings - descendants of
                                                the same reaper. */
         struct mtx        p_mtx;                /* (n) Lock for this struct. */
         struct mtx        p_statmtx;        /* Lock for the stats */
         struct mtx        p_itimmtx;        /* Lock for the virt/prof timers */
         struct mtx        p_profmtx;        /* Lock for the profiling */
+        struct mtx        p_rtmtx;        /* Lock for the realtime ucred-racct access */
         struct ksiginfo *p_ksi;        /* Locked by parent proc lock */
         sigqueue_t      p_sigqueue;     /* (c) Sigs not delivered to a td. */
 #define p_siglist       p_sigqueue.sq_signals
         pid_t           p_oppid;        /* (c + e) Real parent pid. */
 
 /* The following fields are all zeroed upon creation in fork. */
 #define p_startzero     p_vmspace
         struct vmspace        *p_vmspace;        /* (b) Address space. */

 
 #define PROC_ITIMLOCK(p)        mtx_lock_spin(&(p)->p_itimmtx)
 #define PROC_ITIMUNLOCK(p)      mtx_unlock_spin(&(p)->p_itimmtx)
 #define PROC_ITIMLOCK_ASSERT(p, type)   mtx_assert(&(p)->p_itimmtx, (type))
 
 #define PROC_PROFLOCK(p)        mtx_lock_spin(&(p)->p_profmtx)
 #define PROC_PROFUNLOCK(p)      mtx_unlock_spin(&(p)->p_profmtx)
 #define PROC_PROFLOCK_ASSERT(p, type)   mtx_assert(&(p)->p_profmtx, (type))
+
+#define PROC_RTLOCK(p)          mtx_lock_spin(&(p)->p_rtmtx)
+#define PROC_RTUNLOCK(p)        mtx_unlock_spin(&(p)->p_rtmtx)
+#define PROC_RTLOCK_ASSERT(p, type)     mtx_assert(&(p)->p_rtmtx, (type))
 
 /* These flags are kept in p_flag. */
 #define P_ADVLOCK       0x00000001      /* Process may hold a POSIX advisory
                                            lock. */
 #define P_CONTROLT      0x00000002      /* Has a controlling terminal. */
 #define P_KPROC         0x00000004      /* Kernel process. */
 #define P_UNUSED3       0x00000008      /* --available-- */
 #define P_PPWAIT        0x00000010      /* Parent is waiting for child to

head/secure/caroot/Makefile

  *      s - see sleepq_switch(), sleeping_on_old_rtc(), and sleep(9)
  *      t - thread lock
  *      u - process stat lock
  *      w - process timer lock
  *      x - created at fork, only changes during single threading in exec
  *      y - created at first aio, doesn't change until exit or exec at which
  *          point we are single-threaded and only curthread changes it
  *      z - zombie threads lock
+ *      R - process rt-racct lock
  *
  * If the locking key specifies two identifiers (for example, p_pptr) then
  * either lock is sufficient for read access, but both locks must be held
  * for write access.
  */
 struct cpuset;
 struct filecaps;
 struct filemon;
#define td_startzero td_flags
         struct rusage        td_ru;                /* (t) rusage information. */
         struct rusage_ext td_rux;        /* (t) Internal rusage information. */
         uint64_t        td_incruntime;  /* (t) Cpu ticks to transfer to proc. */
         uint64_t        td_runtime;     /* (t) How many cpu ticks we've run. */
         u_int           td_pticks;      /* (t) Statclock hits for profiling */
         u_int           td_sticks;      /* (t) Statclock hits in system mode. */
         u_int           td_iticks;      /* (t) Statclock hits in intr mode. */
         u_int           td_uticks;      /* (t) Statclock hits in user mode. */
+        uint64_t        td_ltruntime;   /* (R) Still unprocessed cpu ticks */
+        uint64_t        td_rtpersec;    /* (R) Avg cpu ticks per second */
+        int             td_rtlastticks; /* (R) Last recalc hardclock tick */
+        int             td_pad1;        /* XXX avoid realigning all below */
         int             td_intrval;     /* (t) Return value for sleepq. */
         sigset_t        td_oldsigmask;  /* (k) Saved mask from pre sigpause. */
         volatile u_int        td_generation;        /* (k) For detection of preemption */
         stack_t         td_sigstk;      /* (k) Stack ptr and on-stack flag. */
         int             td_xsig;        /* (c) Signal for ptrace */
         u_long          td_profil_addr; /* (k) Temporary addr until AST. */
         u_int           td_profil_ticks; /* (k) Temporary ticks until AST. */
         char                td_name[MAXCOMLEN + 1];        /* (*) Thread name. */

 
 /*
  * Process structure.
  */
 struct proc {
         LIST_ENTRY(proc) p_list;        /* (d) List of all processes. */
         TAILQ_HEAD(, thread) p_threads;        /* (c) all threads. */
         struct mtx      p_slock;        /* process spin lock */
         struct ucred        *p_ucred;        /* (c) Process owner's identity. */
         struct filedesc        *p_fd;                /* (b) Open files. */
         struct filedesc_to_leader *p_fdtol; /* (b) Tracking node */
         struct pwddesc        *p_pd;                /* (b) Cwd, chroot, jail, umask */
         struct pstats        *p_stats;        /* (b) Accounting/statistics (CPU). */
         struct plimit        *p_limit;        /* (c) Resource limits. */
         struct callout        p_limco;        /* (c) Limit callout handle */
         struct sigacts        *p_sigacts;        /* (x) Signal actions, state (CPU). */
 
struct proc {
         LIST_HEAD(, proc) p_reaplist;        /* (e) List of my descendants
                                                (if I am reaper). */
         LIST_ENTRY(proc) p_reapsibling;        /* (e) List of siblings - descendants of
                                                the same reaper. */
         struct mtx        p_mtx;                /* (n) Lock for this struct. */
         struct mtx        p_statmtx;        /* Lock for the stats */
         struct mtx        p_itimmtx;        /* Lock for the virt/prof timers */
         struct mtx        p_profmtx;        /* Lock for the profiling */
+        struct mtx        p_rtmtx;        /* Lock for the realtime ucred-racct access */
         struct ksiginfo *p_ksi;        /* Locked by parent proc lock */
         sigqueue_t      p_sigqueue;     /* (c) Sigs not delivered to a td. */
 #define p_siglist       p_sigqueue.sq_signals
         pid_t           p_oppid;        /* (c + e) Real parent pid. */
 
 /* The following fields are all zeroed upon creation in fork. */
 #define p_startzero     p_vmspace
         struct vmspace        *p_vmspace;        /* (b) Address space. */

 
 #define PROC_ITIMLOCK(p)        mtx_lock_spin(&(p)->p_itimmtx)
 #define PROC_ITIMUNLOCK(p)      mtx_unlock_spin(&(p)->p_itimmtx)
 #define PROC_ITIMLOCK_ASSERT(p, type)   mtx_assert(&(p)->p_itimmtx, (type))
 
 #define PROC_PROFLOCK(p)        mtx_lock_spin(&(p)->p_profmtx)
 #define PROC_PROFUNLOCK(p)      mtx_unlock_spin(&(p)->p_profmtx)
 #define PROC_PROFLOCK_ASSERT(p, type)   mtx_assert(&(p)->p_profmtx, (type))
+
+#define PROC_RTLOCK(p)          mtx_lock_spin(&(p)->p_rtmtx)
+#define PROC_RTUNLOCK(p)        mtx_unlock_spin(&(p)->p_rtmtx)
+#define PROC_RTLOCK_ASSERT(p, type)     mtx_assert(&(p)->p_rtmtx, (type))
 
 /* These flags are kept in p_flag. */
 #define P_ADVLOCK       0x00000001      /* Process may hold a POSIX advisory
                                            lock. */
 #define P_CONTROLT      0x00000002      /* Has a controlling terminal. */
 #define P_KPROC         0x00000004      /* Kernel process. */
 #define P_UNUSED3       0x00000008      /* --available-- */
 #define P_PPWAIT        0x00000010      /* Parent is waiting for child to