Page MenuHomeFreeBSD
Differential D43071

periodic: Make security diff(1) output as small is possible
ClosedPublic
Actions

Authored by michaelo on Dec 15 2023, 2:30 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Mar 18, 8:31 PM
Unknown Object (File)
Mon, Mar 17, 7:31 AM
Unknown Object (File)
Sun, Mar 16, 10:50 AM
Unknown Object (File)
Feb 22 2025, 2:13 PM
Unknown Object (File)
Feb 22 2025, 1:56 PM
Unknown Object (File)
Feb 21 2025, 10:52 AM
Unknown Object (File)
Feb 15 2025, 1:33 AM
Unknown Object (File)
Feb 12 2025, 4:16 AM
View All 63 Files
Subscribers
guest-patmaddox
imp

Details

Reviewers
jrm
otis
emaste
• karels
netchild
Commits
rG6d9195b5f763: periodic: Make security diff(1) output as small is possible
rG538994626b9f: periodic: Make security diff(1) output as small is possible
rG3aa71ea7c231: periodic: Make security diff(1) output as small is possible
Summary

Make, by default, security diff(1) produce a unified output with a context of
zero (0) lines. This reduces output of unrelated lines in e-mails delivered
to root.

PR: 270266
Approved by: jrm (mentor), emaste, karels
MFC after: 1 month
Relnotes: yes

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

michaelo created this revision.Dec 15 2023, 2:30 PM
Herald added a subscriber: imp. · View Herald TranscriptDec 15 2023, 2:30 PM
michaelo requested review of this revision.Dec 15 2023, 2:30 PM
Harbormaster completed remote builds in B54961: Diff 131470.Dec 15 2023, 2:30 PM
michaelo added a comment.Dec 15 2023, 2:31 PM

As requested by @karels, this is now a separate review, with target MFC after one month.

• karels accepted this revision.Dec 15 2023, 5:04 PM

Double-checking the places where this gets used, I don't think context is important. I agree with the long MFC just in case.

This revision is now accepted and ready to land.Dec 15 2023, 5:04 PM
jrm accepted this revision.Dec 15 2023, 5:13 PM
guest-patmaddox added a subscriber: guest-patmaddox.Dec 16 2023, 12:26 PM
Closed by commit rG3aa71ea7c231: periodic: Make security diff(1) output as small is possible (authored by michaelo). · Explain WhyDec 31 2023, 10:18 AM
This revision was automatically updated to reflect the committed changes.
michaelo added a commit: rG3aa71ea7c231: periodic: Make security diff(1) output as small is possible.
michaelo added a commit: rG538994626b9f: periodic: Make security diff(1) output as small is possible.Jan 30 2024, 11:43 AM
michaelo added a commit: rG6d9195b5f763: periodic: Make security diff(1) output as small is possible.

Revision Contents
Changeset List

PathSize
share/
man/
man5/
5 lines
usr.sbin/
periodic/
2 lines

Diff 132030

View Options

share/man/man5/periodic.conf.5

Context not available.
regs[0] = leaf + 1; regs[0] = leaf + 1;
if (regs[0] >= leaf) { if (regs[0] >= leaf) {
enum VM_GUEST prev_vm_guest = vm_guest;
for (i = 0; i < nitems(vm_cpuids); i++) for (i = 0; i < nitems(vm_cpuids); i++)
if (strncmp((const char *)&regs[1], if (strncmp((const char *)&regs[1],
vm_cpuids[i].vm_cpuid, 12) == 0) { vm_cpuids[i].vm_cpuid, 12) == 0) {
Context not available.
* specific hypervisor, record the base, high value, * specific hypervisor, record the base, high value,
* and vendor identifier. * and vendor identifier.
*/ */
if (vm_guest != VM_GUEST_VM || leaf == 0x40000000) { if (vm_guest != prev_vm_guest || leaf == 0x40000000) {
hv_base = leaf; hv_base = leaf;
hv_high = regs[0]; hv_high = regs[0];
((u_int *)&hv_vendor)[0] = regs[1]; ((u_int *)&hv_vendor)[0] = regs[1];
Context not available.
* If we found a specific hypervisor, then * If we found a specific hypervisor, then
* we are finished. * we are finished.
*/ */
if (vm_guest != VM_GUEST_VM) if (vm_guest != VM_GUEST_VM &&
/*
* Xen and other hypervisors can expose the
* HyperV signature in addition to the
* native one in order to support Viridian
* extensions for Windows guests.
*
* Do the full cpuid scan if HyperV is
* detected, as the native hypervisor is
* preferred.
markjUnsubmitted
Not Done
Inline Actions

Do you need to modify the enclosing if statement as well? I think it assumes that vm_guest will only be assigned once.

markj: Do you need to modify the enclosing if statement as well? I think it assumes that `vm_guest`…
roygerAuthorUnsubmitted
Done
Inline Actions

bah, indeed, or else it will update the cached leaf even if no hypervisor was found. Will update the diff.

royger: bah, indeed, or else it will update the cached leaf even if no hypervisor was found. Will…
*/
vm_guest != VM_GUEST_HV)
return; return;
} }
} }
Context not available.
View Options

usr.sbin/periodic/periodic.conf

Context not available.
regs[0] = leaf + 1; regs[0] = leaf + 1;
if (regs[0] >= leaf) { if (regs[0] >= leaf) {
enum VM_GUEST prev_vm_guest = vm_guest;
for (i = 0; i < nitems(vm_cpuids); i++) for (i = 0; i < nitems(vm_cpuids); i++)
if (strncmp((const char *)&regs[1], if (strncmp((const char *)&regs[1],
vm_cpuids[i].vm_cpuid, 12) == 0) { vm_cpuids[i].vm_cpuid, 12) == 0) {
Context not available.
* specific hypervisor, record the base, high value, * specific hypervisor, record the base, high value,
* and vendor identifier. * and vendor identifier.
*/ */
if (vm_guest != VM_GUEST_VM || leaf == 0x40000000) { if (vm_guest != prev_vm_guest || leaf == 0x40000000) {
hv_base = leaf; hv_base = leaf;
hv_high = regs[0]; hv_high = regs[0];
((u_int *)&hv_vendor)[0] = regs[1]; ((u_int *)&hv_vendor)[0] = regs[1];
Context not available.
* If we found a specific hypervisor, then * If we found a specific hypervisor, then
* we are finished. * we are finished.
*/ */
if (vm_guest != VM_GUEST_VM) if (vm_guest != VM_GUEST_VM &&
/*
* Xen and other hypervisors can expose the
* HyperV signature in addition to the
* native one in order to support Viridian
* extensions for Windows guests.
*
* Do the full cpuid scan if HyperV is
* detected, as the native hypervisor is
* preferred.
markjUnsubmitted
Not Done
Inline Actions

Do you need to modify the enclosing if statement as well? I think it assumes that vm_guest will only be assigned once.

markj: Do you need to modify the enclosing if statement as well? I think it assumes that `vm_guest`…
roygerAuthorUnsubmitted
Done
Inline Actions

bah, indeed, or else it will update the cached leaf even if no hypervisor was found. Will update the diff.

royger: bah, indeed, or else it will update the cached leaf even if no hypervisor was found. Will…
*/
vm_guest != VM_GUEST_HV)
return; return;
} }
} }
Context not available.