Page MenuHomeFreeBSD

bhyve: Enable Capsicum for snapshots
ClosedPublic

Authored by gusev.vitaliy_gmail.com on Mar 2 2023, 6:23 PM.
Referenced Files
Unknown Object (File)
Thu, Dec 5, 4:45 AM
Unknown Object (File)
Sat, Nov 30, 5:54 AM
Unknown Object (File)
Mon, Nov 25, 7:37 AM
Unknown Object (File)
Sun, Nov 24, 10:37 AM
Unknown Object (File)
Fri, Nov 22, 6:56 PM
Unknown Object (File)
Fri, Nov 22, 11:22 AM
Unknown Object (File)
Thu, Nov 21, 3:16 AM
Unknown Object (File)
Wed, Nov 20, 8:19 AM

Details

Summary

Sponsored by: vStack

Test Plan

Compile, verify that capsicum is not disabled during compilation. Run VM, Suspend, Resume.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

usr.sbin/bhyve/Makefile
94–95

How are these casper libraries used? I can't find references to them anywhere in the bhyve code.

usr.sbin/bhyve/Makefile
94–95

I am not expert in casper library, but when I removed linking those libraries, I got:

ld: error: /usr/lib/lib9p.so: undefined reference to cap_getpwuid_r [--no-allow-shlib-undefined]
ld: error: /usr/lib/lib9p.so: undefined reference to cap_getgrgid_r [--no-allow-shlib-undefined]
ld: error: /usr/lib/lib9p.so: undefined reference to cap_init [--no-allow-shlib-undefined]
ld: error: /usr/lib/lib9p.so: undefined reference to cap_service_open [--no-allow-shlib-undefined]
ld: error: /usr/lib/lib9p.so: undefined reference to cap_setpassent [--no-allow-shlib-undefined]
ld: error: /usr/lib/lib9p.so: undefined reference to cap_setgroupent [--no-allow-shlib-undefined]
ld: error: /usr/lib/lib9p.so: undefined reference to cap_close [--no-allow-shlib-undefined]
ld: error: /usr/lib/lib9p.so: undefined reference to cap_getpwnam [--no-allow-shlib-undefined]

So I assume, it is used in lib9p.

usr.sbin/bhyve/Makefile
94–95

As idea, just revert this commit 966026246e62769f3bcd8247a47fe0f4f0433aba

Diff would be:

--- b/usr.sbin/bhyve/Makefile
+++ a/usr.sbin/bhyve/Makefile
@@ -83,16 +83,7 @@ CFLAGS.kernemu_dev.c+=       -I${SRCTOP}/sys/amd64
 .PATH:  ${BHYVE_SYSDIR}/sys/amd64/vmm
 SRCS+= vmm_instruction_emul.c
 
-LIBADD=        vmmapi md pthread z util sbuf cam 9p
-
-if ${MK_CASPER} != "no"
-LIBADD+=       casper
-LIBADD+=       cap_pwd
-LIBADD+=       cap_grp
-# Temporary disable capsicum, until we integrate checkpoint code with it.
-#CFLAGS+=-DWITH_CASPER
-.endif
-
+LIBADD=        vmmapi md pthread z util sbuf cam 9p casper cap_pwd cap_grp
 .if ${MK_BHYVE_SNAPSHOT} != "no"
 LIBADD+= ucl xo
 .endif
usr.sbin/bhyve/Makefile
94–95

The problem is that lib9p does not declare its dependency on casper/cap_grp/cap_pwd. Its makefile, lib/lib9p/Makefile, should include them in its LIBADD definition instead.

Moved casper dependency to lib9p.

Check 1:

lib/lib9p $ env MK_CASPER=no make

$ ldd /usr/obj/usr/home/vetal/work/freebsd/amd64.amd64/lib/lib9p/lib9p.so
/usr/obj/usr/home/vetal/work/freebsd/amd64.amd64/lib/lib9p/lib9p.so:

libsbuf.so.6 => /lib/libsbuf.so.6 (0x18d87218a000)
libc.so.7 => /lib/libc.so.7 (0x18d86e296000)

Check 2:
lib/lib9p $ env MK_CASPER=no make

$ ldd /usr/obj/usr/home/vetal/work/freebsd/amd64.amd64/lib/lib9p/lib9p.so
/usr/obj/usr/home/vetal/work/freebsd/amd64.amd64/lib/lib9p/lib9p.so:

libsbuf.so.6 => /lib/libsbuf.so.6 (0x155cf2448000)
libcasper.so.1 => /lib/libcasper.so.1 (0x155cf335d000)
libcap_pwd.so.1 => /lib/casper/libcap_pwd.so.1 (0x155cf4f99000)
libcap_grp.so.1 => /lib/casper/libcap_grp.so.1 (0x155cf3fea000)
libc.so.7 => /lib/libc.so.7 (0x155cef392000)
libnv.so.1 => /lib/libnv.so.1 (0x155cf5a18000)
gusev.vitaliy_gmail.com added inline comments.
usr.sbin/bhyve/Makefile
94–95

Done.

Looks like this patch needs to be rebased.

Looks like this patch needs to be rebased.

https://reviews.freebsd.org/D38858 also needs to be addressed before this patch is committed.

In D38860#887381, @rew wrote:

https://reviews.freebsd.org/D38858 also needs to be addressed before this patch is committed.

I've dropped my request for changes in D38858 - there's nothing blocking this review from being landed.

In D38860#887537, @rew wrote:
In D38860#887381, @rew wrote:

https://reviews.freebsd.org/D38858 also needs to be addressed before this patch is committed.

I've dropped my request for changes in D38858 - there's nothing blocking this review from being landed.

Good. Thanks!

This revision is now accepted and ready to land.Mar 27 2023, 11:13 AM
This revision was automatically updated to reflect the committed changes.