Page MenuHomeFreeBSD

Add basic blacklist build support
ClosedPublic

Authored by lidl on Apr 11 2016, 2:37 PM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 26 2024, 12:17 PM
Unknown Object (File)
Feb 24 2024, 11:01 AM
Unknown Object (File)
Feb 24 2024, 11:01 AM
Unknown Object (File)
Feb 24 2024, 11:01 AM
Unknown Object (File)
Feb 24 2024, 11:00 AM
Unknown Object (File)
Feb 24 2024, 11:00 AM
Unknown Object (File)
Feb 23 2024, 10:59 AM
Unknown Object (File)
Jan 1 2024, 4:58 PM

Details

Summary

Add support for building NetBSD's blacklist library, blacklistd daemon
and blacklistctl control program to FreeBSD. Enhance the 520.pfdenied
periodic script to report on the automatically generated blacklist
tables. Add a startup script for blacklistd.

Depends on D5912

Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

lidl retitled this revision from to Add basic blacklist build support.
lidl updated this object.
lidl edited the test plan for this revision. (Show Details)
lidl added reviewers: rpaulo, emaste, gnn.
etc/periodic/security/520.pfdenied
51

Why enforcing nawk and not using the regular awk?

lib/libblacklist/Makefile
10

I do not think it is necessary to add it to /lib instead of the regular /usr/lib given there is "nothing vital about this lib"

sbin/blacklistctl/Makefile
13 ↗(On Diff #15081)

why not adding in a single line?

BTW the LDFLAGS is not necessary here given this is already default

sbin/blacklistd/Makefile
3 ↗(On Diff #15081)

Useless inclusion

15 ↗(On Diff #15081)

Same as above

lib/libblacklist/Makefile
10

Do we have daemons in /bin or /sbin that might (later on) depend on blacklistd, and could start before /usr is mounted?

etc/periodic/security/520.pfdenied
51

I am just using what was there before - I don't know why it is currently specified as 'nawk'.

lib/libblacklist/Makefile
10

OK, I'll move it to /usr/lib. I was thinking that sshd did not have a requirement for /usr/lib, but checking shows that it does require /usr/lib.

sbin/blacklistctl/Makefile
13 ↗(On Diff #15081)

I looked at a few different Makefiles that use LIBADD, and the ones already in the tree do it both ways - listing on a single line, and listing on multiple lines. I'd be happy to make it a single line.

As for the LDFLAGS settings, it doesn't compile on a system that doesn't already have it installed without setting LDFLAGS. Once the library is already installed, the LDFLAGS isn't needed. Until the library is installed, it needs LDFLAGS to be set, to find the library file in the OBJDIR.

Since the introduction of this will be a new feature, not setting LDFLAGS would break everyone's build.

sbin/blacklistd/Makefile
3 ↗(On Diff #15081)

I will fix this.

15 ↗(On Diff #15081)

I'll smash the LIBADD lines into one.

Same response for why LDFLAGS needs to be set.

In light of the request to move the library into /usr/lib, rather than /lib, I wonder if the binaries and helper program ought to be installed into /usr/sbin (rather than /sbin) and the helper into /usr/libexec too?

In D5913#126142, @lidl wrote:

In light of the request to move the library into /usr/lib, rather than /lib, I wonder if the binaries and helper program ought to be installed into /usr/sbin (rather than /sbin) and the helper into /usr/libexec too?

Yes

etc/periodic/security/520.pfdenied
51

It came from rS138061. This one is the only case of nawk in etc/ (vs. 31 awk). It probably makes sense to switch it in a separate commit.

lib/libblacklist/Makefile
10

Note that since sshd itself is in /usr/sbin /usr must be mounted for it to start anyhow :-)

share/mk/bsd.libnames.mk
25–27

I'd just set the variable unconditionally.

lidl edited edge metadata.

Address code review comments: move lib to /usr/lib, move binaries
into /usr/sbin, add separate config file, add additional man pages
to the OptionalObsoleteFiles.inc file.

Does FreeBSD have style guide for makefiles?

VAR+= \
<TAB>value \
<TAB>value2 \

etc is both more efficient than lots of VAR+= and also aids review when changes are made (assuming the list is kept sorted)

lib/libblacklist/Makefile
4

FWIW ${.CURDIR:H:H} results in much neater paths than
${.CURDIR}/../..

lidl updated this object.
lidl edited edge metadata.
lidl marked an inline comment as done.

Updated to address review comments.

Add copyright headers to FreeBSD Foundation where needed.

rpaulo edited edge metadata.
rpaulo added inline comments.
libexec/Makefile
8

I think we tend to avoid '-' in variable names.

share/mk/src.libnames.mk
182

Remove empty space.

This revision is now accepted and ready to land.May 27 2016, 7:20 PM
libexec/Makefile
8

It's not my exact preference either, but there's the existence proof of both "_rtld-elf" and "_tftp-proxy" in the same list of variables. So it's already being done. (Perhaps it should be undone, but that would be a different set of patches.)

I was pretty careful to make sure that I wasn't adding something that did not match the existing code.

share/mk/src.libnames.mk
182

I'm torn about doing this. The code above (setting _LIBRARIES) ends the same way, with a trailing backslash, and the obligatory blank line. As does the code below my addition (appending to _LIBRARIES for MK_OFED). Another trailing backslash and followed by a blank line.

So, violate the style of the surrounding code, or leave the blank line and match the style? I left the blank line to match the existing style.

etc/periodic/security/520.pfdenied
48

fwiw there is no need to comment blacklistd

etc/periodic/security/520.pfdenied
48

Fixed in my local repository, will be fixed when I post the next review update / commit the code.

This revision was automatically updated to reflect the committed changes.