Capsicumizing wall

[hanslu952_gmail.com]

Summary

The first problem is to use pdfork.
because fork() is disallowed in capability mode,
we use pdfork() to replace ,the semantic is same as rwhod
The second problem is to limit the file descriptor used by open.
it sets up a specific right (write) for a file descriptor and then
attempts to enforce the limitation. If the operation fails,
the program will terminate with a specific error message

Test Plan

Nonblocking test

setup a c program to fill up the pipe of /dev/pts/$any num
cc -o nonblocking nonblocking.c
./nonblocking
make
ktrace ./wall-test msg
kdump -f ktrace.out

normal test
make
ktrace ./wall-test msg
kdump -f ktrace.out

[oshogbo]

In the "Test plan" please provide an example of testing blocking (forked version) and unblocked version.

usr.bin/wall/ttymsg.c

57

Why this has to be global?

66

I guess we don't need foked and fdp.

128

Does this code complies? I think you have a typo in variable name.

usr.bin/wall/wall.c

105

No need for extra line.

173

I think we have to enter capability mode a little bit earlier then before exit.
The cap_enter/caph_enter function is a barrier which says here starts a "untrusted part", know you are protecting nothing.

[hanslu952_gmail.com]

• Fix pdfork and take off unneccessary code
• remove line break

[hanslu952_gmail.com]

• fix format of ttymsg

[oshogbo]

Hym I don't think this is complete patch.
Can you try to regenerate git diff -U99999 first_commit^ (the ^ is important)

[hanslu952_gmail.com]

Reupload the patch

[oshogbo]

It still doesn't seem right.

[hanslu952_gmail.com]

Trying on more earlier version

[hanslu952_gmail.com]

Sorry I found it

[lwhsu]

There are many whitespace changes, if possible, please don't change the original ones (even they are wrong) in a feature addition change, or it would cause unnecessary review complexity.

[oshogbo]

usr.bin/wall/ttymsg.c

123

Why we are entering capability mode here?

128

How can this work?
You are reassigning fd (which was the open file) to a process descriptor.