Page MenuHomeFreeBSD
Differential D9205

Change ownership of rundeck/server/lib et al.
ClosedPublic
Actions

Authored by ler on Jan 17 2017, 12:50 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Apr 19, 9:49 PM
Unknown Object (File)
Tue, Apr 8, 10:20 AM
Unknown Object (File)
Tue, Mar 25, 2:27 AM
Unknown Object (File)
Sun, Mar 23, 11:22 PM
Unknown Object (File)
Mar 9 2025, 11:35 AM
Unknown Object (File)
Mar 4 2025, 12:27 PM
Unknown Object (File)
Mar 4 2025, 11:43 AM
Unknown Object (File)
Feb 17 2025, 2:35 AM
View All Files
Subscribers
mat

Details

Reviewers
adamw
rene
Commits
rP431715: Change ownership of rundeck/server/lib et al.
Summary

Change ownership of rundeck/server/lib et al.
Address poudriere issues
bump PORTREVISION

PR: 202732
Submitted by: Mark C Ballew (ballew sublinear net)
Approved by: (adamw|rene) (mentor)
MFH: 2017Q1 (blanket)

Test Plan

poudriere (ok)
http://home.lerctr.org:8888/data/live-ler-checkout/2017-01-16_18h42m54s/logs/rundeck-2.3.2_1.log

portlint (ok)
borg.lerctr.org ~/FreeBSD/ports/sysutils/rundeck $ portlint -C
WARN: Makefile: possible use of absolute pathname "/var/log/rundeck.log".
0 fatal errors and 1 warning found.
borg.lerctr.org ~/FreeBSD/ports/sysutils/rundeck $

Diff Detail

Repository
rP FreeBSD ports repository
Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 6813
Build 7019: arc lint + arc unit

Event Timeline

ler updated this revision to Diff 24091.Jan 17 2017, 12:50 AM
ler retitled this revision from to Change ownership of rundeck/server/lib et al..
ler updated this object.
ler edited the test plan for this revision. (Show Details)
ler added reviewers: adamw, rene.
Herald added a subscriber: mat. · View Herald TranscriptJan 17 2017, 12:50 AM
adamw edited edge metadata.Jan 17 2017, 12:51 AM

You should follow portlint's advice.

ler updated this object.Jan 17 2017, 12:52 AM
ler edited edge metadata.
adamw added inline comments.Jan 17 2017, 12:52 AM
sysutils/rundeck/pkg-plist
3

@dir goes at the end of the plist.

adamw added inline comments.Jan 17 2017, 12:54 AM
sysutils/rundeck/Makefile
42

${MKDIR} commands should be muted.

43

Now that you have @dir in the plist, you don't need to create this file.

sysutils/rundeck/pkg-plist
4

You have @dir. You don't need to trick the system with a .keep file.

ler updated this revision to Diff 24092.Jan 17 2017, 12:55 AM

Address portlint DATADIR

ler updated this revision to Diff 24093.Jan 17 2017, 12:56 AM

Uh, use the right diff.

ler edited the test plan for this revision. (Show Details)Jan 17 2017, 12:57 AM
ler updated this revision to Diff 24094.Jan 17 2017, 12:58 AM

update plist per Adam

ler updated this revision to Diff 24095.Jan 17 2017, 1:05 AM

Address Adam's comment re: .keep

ler marked 4 inline comments as done.Jan 17 2017, 1:06 AM
adamw accepted this revision.Jan 17 2017, 1:13 AM
adamw edited edge metadata.
adamw added inline comments.
sysutils/rundeck/pkg-plist
4

These @dir entries should be in reverse-alphabetical order. Just switch them before committing.

This revision is now accepted and ready to land.Jan 17 2017, 1:13 AM
Closed by commit rP431715: Change ownership of rundeck/server/lib et al. (authored by ler). · Explain WhyJan 17 2017, 1:22 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
sysutils/
rundeck/
5 lines
4 lines

Diff 24093

View Options

sysutils/rundeck/Makefile

Show All 24 Lines
* *
* $FreeBSD$ * $FreeBSD$
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__FBSDID("$FreeBSD$"); __FBSDID("$FreeBSD$");
#include <sys/param.h> #include <sys/param.h>
#ifndef WITHOUT_CAPSICUM
#include <sys/capsicum.h>
#endif
#include <sys/queue.h> #include <sys/queue.h>
#include <sys/errno.h> #include <sys/errno.h>
#include <sys/stat.h> #include <sys/stat.h>
#include <sys/ioctl.h> #include <sys/ioctl.h>
#include <sys/disk.h> #include <sys/disk.h>
#include <assert.h> #include <assert.h>
#include <err.h> #include <err.h>
#include <fcntl.h> #include <fcntl.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <pthread.h> #include <pthread.h>
#include <pthread_np.h> #include <pthread_np.h>
#include <signal.h> #include <signal.h>
#include <sysexits.h>
#include <unistd.h> #include <unistd.h>
#include <machine/atomic.h> #include <machine/atomic.h>
#include "bhyverun.h" #include "bhyverun.h"
#include "mevent.h" #include "mevent.h"
#include "block_if.h" #include "block_if.h"
▲ Show 20 Lines • Show All 339 Lines • ▼ Show 20 Linesblockif_open(const char *optstr, const char *ident)
char name[MAXPATHLEN]; char name[MAXPATHLEN];
char *nopt, *xopts, *cp; char *nopt, *xopts, *cp;
struct blockif_ctxt *bc; struct blockif_ctxt *bc;
struct stat sbuf; struct stat sbuf;
struct diocgattr_arg arg; struct diocgattr_arg arg;
off_t size, psectsz, psectoff; off_t size, psectsz, psectoff;
int extra, fd, i, sectsz; int extra, fd, i, sectsz;
int nocache, sync, ro, candelete, geom, ssopt, pssopt; int nocache, sync, ro, candelete, geom, ssopt, pssopt;
#ifndef WITHOUT_CAPSICUM
cap_rights_t rights;
u_long cmds[] = {DIOCGFLUSH, DIOCGDELETE};
#endif
pthread_once(&blockif_once, blockif_init); pthread_once(&blockif_once, blockif_init);
fd = -1; fd = -1;
ssopt = 0; ssopt = 0;
nocache = 0; nocache = 0;
sync = 0; sync = 0;
ro = 0; ro = 0;
▲ Show 20 Lines • Show All 41 Lines • ▼ Show 20 Lines if (fd < 0) {
goto err; goto err;
} }
if (fstat(fd, &sbuf) < 0) { if (fstat(fd, &sbuf) < 0) {
warn("Could not stat backing file %s", nopt); warn("Could not stat backing file %s", nopt);
goto err; goto err;
} }
#ifndef WITHOUT_CAPSICUM
grehanUnsubmitted
Not Done
Inline Actions

fsync needs to be added here, or an ahci-hd file-backed disk image will fail on FreeBSD guest shutdown with

(ada0:ahcich0:0:0:0): FLUSHCACHE48. ACB: ea 00 00 00 00 40 00 00 00 00 00 00
(ada0:ahcich0:0:0:0): CAM status: ATA Status Error
(ada0:ahcich0:0:0:0): ATA status: 41 (DRDY ERR), error: 04 (ABRT )
(ada0:ahcich0:0:0:0): RES: 41 04 00 00 00 40 00 00 00 00 00
(ada0:ahcich0:0:0:0): Retrying command
(ada0:ahcich0:0:0:0): FLUSHCACHE48. ACB: ea 00 00 00 00 40 00 00 00 00 00 00
(ada0:ahcich0:0:0:0): CAM status: ATA Status Error
(ada0:ahcich0:0:0:0): ATA status: 41 (DRDY ERR), error: 04 (ABRT )
(ada0:ahcich0:0:0:0): RES: 41 04 00 00 00 40 00 00 00 00 00
(ada0:ahcich0:0:0:0): Error 5, Retries exhausted
(ada0:ahcich0:0:0:0): Synchronize cache failed

#ifndef WITHOUT_CAPSICUM

  • cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK, CAP_WRITE);
  • if (ro)

+ cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK, CAP_WRITE,
+ CAP_FSYNC);
+ if (ro) {

		cap_rights_clear(&rights, CAP_WRITE);

+ cap_rights_clear(&rights, CAP_FSYNC);
+ }

grehan: fsync needs to be added here, or an ahci-hd file-backed disk image will fail on FreeBSD guest…
cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK, CAP_WRITE);
if (ro)
cap_rights_clear(&rights, CAP_WRITE);
oshogboUnsubmitted
Not Done
Inline Actions

I'm not sure if here the reverse logic would be more secure.

oshogbo: I'm not sure if here the reverse logic would be more secure.
emasteUnsubmitted
Not Done
Inline Actions

That is:

cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK);
if (!ro)
        cap_rights_set(&rights, CAP_FSYNC, CAP_WRITE);

I agree that looks preferable.

emaste: That is: ``` cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK); if (!ro)…
if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS)
errx(EX_OSERR, "Unable to apply rights for sandbox");
#endif
/* /*
* Deal with raw devices * Deal with raw devices
*/ */
size = sbuf.st_size; size = sbuf.st_size;
sectsz = DEV_BSIZE; sectsz = DEV_BSIZE;
psectsz = psectoff = 0; psectsz = psectoff = 0;
candelete = geom = 0; candelete = geom = 0;
if (S_ISCHR(sbuf.st_mode)) { if (S_ISCHR(sbuf.st_mode)) {
Show All 9 Lines if (S_ISCHR(sbuf.st_mode)) {
strlcpy(arg.name, "GEOM::candelete", sizeof(arg.name)); strlcpy(arg.name, "GEOM::candelete", sizeof(arg.name));
arg.len = sizeof(arg.value.i); arg.len = sizeof(arg.value.i);
if (ioctl(fd, DIOCGATTR, &arg) == 0) if (ioctl(fd, DIOCGATTR, &arg) == 0)
candelete = arg.value.i; candelete = arg.value.i;
if (ioctl(fd, DIOCGPROVIDERNAME, name) == 0) if (ioctl(fd, DIOCGPROVIDERNAME, name) == 0)
geom = 1; geom = 1;
} else } else
psectsz = sbuf.st_blksize; psectsz = sbuf.st_blksize;
#ifndef WITHOUT_CAPSICUM
if (cap_ioctls_limit(fd, cmds, nitems(cmds)) == -1 && errno != ENOSYS)
errx(EX_OSERR, "Unable to apply rights for sandbox");
#endif
if (ssopt != 0) { if (ssopt != 0) {
if (!powerof2(ssopt) || !powerof2(pssopt) || ssopt < 512 || if (!powerof2(ssopt) || !powerof2(pssopt) || ssopt < 512 ||
ssopt > pssopt) { ssopt > pssopt) {
fprintf(stderr, "Invalid sector size %d/%d\n", fprintf(stderr, "Invalid sector size %d/%d\n",
ssopt, pssopt); ssopt, pssopt);
goto err; goto err;
} }
▲ Show 20 Lines • Show All 329 Lines • Show Last 20 Lines
View Options

sysutils/rundeck/pkg-plist

Show All 24 Lines
* *
* $FreeBSD$ * $FreeBSD$
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__FBSDID("$FreeBSD$"); __FBSDID("$FreeBSD$");
#include <sys/param.h> #include <sys/param.h>
#ifndef WITHOUT_CAPSICUM
#include <sys/capsicum.h>
#endif
#include <sys/queue.h> #include <sys/queue.h>
#include <sys/errno.h> #include <sys/errno.h>
#include <sys/stat.h> #include <sys/stat.h>
#include <sys/ioctl.h> #include <sys/ioctl.h>
#include <sys/disk.h> #include <sys/disk.h>
#include <assert.h> #include <assert.h>
#include <err.h> #include <err.h>
#include <fcntl.h> #include <fcntl.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <pthread.h> #include <pthread.h>
#include <pthread_np.h> #include <pthread_np.h>
#include <signal.h> #include <signal.h>
#include <sysexits.h>
#include <unistd.h> #include <unistd.h>
#include <machine/atomic.h> #include <machine/atomic.h>
#include "bhyverun.h" #include "bhyverun.h"
#include "mevent.h" #include "mevent.h"
#include "block_if.h" #include "block_if.h"
▲ Show 20 Lines • Show All 339 Lines • ▼ Show 20 Linesblockif_open(const char *optstr, const char *ident)
char name[MAXPATHLEN]; char name[MAXPATHLEN];
char *nopt, *xopts, *cp; char *nopt, *xopts, *cp;
struct blockif_ctxt *bc; struct blockif_ctxt *bc;
struct stat sbuf; struct stat sbuf;
struct diocgattr_arg arg; struct diocgattr_arg arg;
off_t size, psectsz, psectoff; off_t size, psectsz, psectoff;
int extra, fd, i, sectsz; int extra, fd, i, sectsz;
int nocache, sync, ro, candelete, geom, ssopt, pssopt; int nocache, sync, ro, candelete, geom, ssopt, pssopt;
#ifndef WITHOUT_CAPSICUM
cap_rights_t rights;
u_long cmds[] = {DIOCGFLUSH, DIOCGDELETE};
#endif
pthread_once(&blockif_once, blockif_init); pthread_once(&blockif_once, blockif_init);
fd = -1; fd = -1;
ssopt = 0; ssopt = 0;
nocache = 0; nocache = 0;
sync = 0; sync = 0;
ro = 0; ro = 0;
▲ Show 20 Lines • Show All 41 Lines • ▼ Show 20 Lines if (fd < 0) {
goto err; goto err;
} }
if (fstat(fd, &sbuf) < 0) { if (fstat(fd, &sbuf) < 0) {
warn("Could not stat backing file %s", nopt); warn("Could not stat backing file %s", nopt);
goto err; goto err;
} }
#ifndef WITHOUT_CAPSICUM
grehanUnsubmitted
Not Done
Inline Actions

fsync needs to be added here, or an ahci-hd file-backed disk image will fail on FreeBSD guest shutdown with

(ada0:ahcich0:0:0:0): FLUSHCACHE48. ACB: ea 00 00 00 00 40 00 00 00 00 00 00
(ada0:ahcich0:0:0:0): CAM status: ATA Status Error
(ada0:ahcich0:0:0:0): ATA status: 41 (DRDY ERR), error: 04 (ABRT )
(ada0:ahcich0:0:0:0): RES: 41 04 00 00 00 40 00 00 00 00 00
(ada0:ahcich0:0:0:0): Retrying command
(ada0:ahcich0:0:0:0): FLUSHCACHE48. ACB: ea 00 00 00 00 40 00 00 00 00 00 00
(ada0:ahcich0:0:0:0): CAM status: ATA Status Error
(ada0:ahcich0:0:0:0): ATA status: 41 (DRDY ERR), error: 04 (ABRT )
(ada0:ahcich0:0:0:0): RES: 41 04 00 00 00 40 00 00 00 00 00
(ada0:ahcich0:0:0:0): Error 5, Retries exhausted
(ada0:ahcich0:0:0:0): Synchronize cache failed

#ifndef WITHOUT_CAPSICUM

  • cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK, CAP_WRITE);
  • if (ro)

+ cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK, CAP_WRITE,
+ CAP_FSYNC);
+ if (ro) {

		cap_rights_clear(&rights, CAP_WRITE);

+ cap_rights_clear(&rights, CAP_FSYNC);
+ }

grehan: fsync needs to be added here, or an ahci-hd file-backed disk image will fail on FreeBSD guest…
cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK, CAP_WRITE);
if (ro)
cap_rights_clear(&rights, CAP_WRITE);
oshogboUnsubmitted
Not Done
Inline Actions

I'm not sure if here the reverse logic would be more secure.

oshogbo: I'm not sure if here the reverse logic would be more secure.
emasteUnsubmitted
Not Done
Inline Actions

That is:

cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK);
if (!ro)
        cap_rights_set(&rights, CAP_FSYNC, CAP_WRITE);

I agree that looks preferable.

emaste: That is: ``` cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_SEEK); if (!ro)…
if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS)
errx(EX_OSERR, "Unable to apply rights for sandbox");
#endif
/* /*
* Deal with raw devices * Deal with raw devices
*/ */
size = sbuf.st_size; size = sbuf.st_size;
sectsz = DEV_BSIZE; sectsz = DEV_BSIZE;
psectsz = psectoff = 0; psectsz = psectoff = 0;
candelete = geom = 0; candelete = geom = 0;
if (S_ISCHR(sbuf.st_mode)) { if (S_ISCHR(sbuf.st_mode)) {
Show All 9 Lines if (S_ISCHR(sbuf.st_mode)) {
strlcpy(arg.name, "GEOM::candelete", sizeof(arg.name)); strlcpy(arg.name, "GEOM::candelete", sizeof(arg.name));
arg.len = sizeof(arg.value.i); arg.len = sizeof(arg.value.i);
if (ioctl(fd, DIOCGATTR, &arg) == 0) if (ioctl(fd, DIOCGATTR, &arg) == 0)
candelete = arg.value.i; candelete = arg.value.i;
if (ioctl(fd, DIOCGPROVIDERNAME, name) == 0) if (ioctl(fd, DIOCGPROVIDERNAME, name) == 0)
geom = 1; geom = 1;
} else } else
psectsz = sbuf.st_blksize; psectsz = sbuf.st_blksize;
#ifndef WITHOUT_CAPSICUM
if (cap_ioctls_limit(fd, cmds, nitems(cmds)) == -1 && errno != ENOSYS)
errx(EX_OSERR, "Unable to apply rights for sandbox");
#endif
if (ssopt != 0) { if (ssopt != 0) {
if (!powerof2(ssopt) || !powerof2(pssopt) || ssopt < 512 || if (!powerof2(ssopt) || !powerof2(pssopt) || ssopt < 512 ||
ssopt > pssopt) { ssopt > pssopt) {
fprintf(stderr, "Invalid sector size %d/%d\n", fprintf(stderr, "Invalid sector size %d/%d\n",
ssopt, pssopt); ssopt, pssopt);
goto err; goto err;
} }
▲ Show 20 Lines • Show All 329 Lines • Show Last 20 Lines