Page MenuHomeFreeBSD
Differential D2440

Remove "capability mode sandbox enabled" messages.
ClosedPublic
Actions

Authored by brooks on May 4 2015, 3:55 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mar 11 2025, 3:03 AM
Unknown Object (File)
Jan 31 2025, 11:27 AM
Unknown Object (File)
Jan 31 2025, 10:26 AM
Unknown Object (File)
Dec 4 2024, 5:19 PM
Unknown Object (File)
Dec 4 2024, 5:16 PM
Unknown Object (File)
Dec 4 2024, 5:15 PM
Unknown Object (File)
Dec 4 2024, 5:13 PM
Unknown Object (File)
Nov 7 2024, 8:46 AM
View All Files
Subscribers
imp

Details

Reviewers
pjd
rwatson
Commits
rS283122: MFC r282436 (the portion that makes sense):
rS282436: Remove "capability mode sandbox enabled" messages.
Summary

These messages serve little purpose and break some scripts:

PR: 199855
Sponsored by: DARPA, AFRL

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage

Event Timeline

brooks updated this revision to Diff 5177.May 4 2015, 3:55 PM
brooks retitled this revision from to Remove "capability mode sandbox enabled" messages..
brooks updated this object.
brooks edited the test plan for this revision. (Show Details)
brooks added reviewers: pjd, rwatson.
Herald added a subscriber: imp. · View Herald TranscriptMay 4 2015, 3:55 PM
brooks added a comment.May 4 2015, 4:05 PM

I'll submit the tcpdump change upstream after this goes in.

rwatson accepted this revision.May 4 2015, 4:08 PM
rwatson edited edge metadata.

Seems reasonable to me. I'd rather take sandboxing for granted and not have output. An interesting question, of course, is whether we want a more mature policy than "Is Capsicum compiled into the kernel?" to control whether to fail stop if sandboxing fails. My intuition is that the status quo is fine there -- i.e., that if Capsicum is present we expect to be in a sandbox, and if not, we don't. You could imagine some sort of assert_cap_sandboxed() but I'm also not convinced that adds anything over the current check on the cap_enter() return value.

This revision is now accepted and ready to land.May 4 2015, 4:08 PM
Closed by commit rS282436: Remove "capability mode sandbox enabled" messages. (authored by brooks). · Explain WhyMay 4 2015, 9:45 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
contrib/
tcpdump/
2 lines
sbin/
ping/
3 lines
usr.bin/
kdump/
2 lines

Diff 5177

View Options

contrib/tcpdump/tcpdump.c

Show First 20 Lines • Show All 83 Lines • ▼ Show 20 Linesfirewire_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
struct m_tag *mtag; struct m_tag *mtag;
union fw_encap *enc; union fw_encap *enc;
struct fw_hwaddr *destfw; struct fw_hwaddr *destfw;
uint8_t speed; uint8_t speed;
uint16_t psize, fsize, dsize; uint16_t psize, fsize, dsize;
struct mbuf *mtail; struct mbuf *mtail;
int unicast, dgl, foff; int unicast, dgl, foff;
static int next_dgl; static int next_dgl;
#ifdef INET #if defined(INET) || defined(INET6)
int is_gw; int is_gw = 0;
#endif #endif
#ifdef MAC #ifdef MAC
error = mac_ifnet_check_transmit(ifp, m); error = mac_ifnet_check_transmit(ifp, m);
if (error) if (error)
goto bad; goto bad;
#endif #endif
if (!((ifp->if_flags & IFF_UP) && if (!((ifp->if_flags & IFF_UP) &&
(ifp->if_drv_flags & IFF_DRV_RUNNING))) { (ifp->if_drv_flags & IFF_DRV_RUNNING))) {
error = ENETDOWN; error = ENETDOWN;
goto bad; goto bad;
} }
#if defined(INET) || defined(INET6)
if (ro != NULL && ro->ro_rt != NULL &&
(ro->ro_rt->rt_flags & RTF_GATEWAY) != 0)
is_gw = 1;
#endif
/* /*
* For unicast, we make a tag to store the lladdr of the * For unicast, we make a tag to store the lladdr of the
* destination. This might not be the first time we have seen * destination. This might not be the first time we have seen
* the packet (for instance, the arp code might be trying to * the packet (for instance, the arp code might be trying to
* re-send it after receiving an arp reply) so we only * re-send it after receiving an arp reply) so we only
* allocate a tag if there isn't one there already. For * allocate a tag if there isn't one there already. For
* multicast, we will eventually use a different tag to store * multicast, we will eventually use a different tag to store
* the channel number. * the channel number.
▲ Show 20 Lines • Show All 52 Lines • ▼ Show 20 Lines case AF_ARP:
m_adj(m, -ah->ar_hln); m_adj(m, -ah->ar_hln);
break; break;
} }
#endif #endif
#ifdef INET6 #ifdef INET6
case AF_INET6: case AF_INET6:
if (unicast) { if (unicast) {
error = nd6_storelladdr(fc->fc_ifp, m, dst, error = nd6_resolve(fc->fc_ifp, is_gw, m, dst,
(u_char *) destfw, NULL); (u_char *) destfw, NULL);
if (error) if (error)
return (error); return (error == EWOULDBLOCK ? 0 : error);
} }
type = ETHERTYPE_IPV6; type = ETHERTYPE_IPV6;
break; break;
#endif #endif
default: default:
if_printf(ifp, "can't handle af%d\n", dst->sa_family); if_printf(ifp, "can't handle af%d\n", dst->sa_family);
error = EAFNOSUPPORT; error = EAFNOSUPPORT;
▲ Show 20 Lines • Show All 670 Lines • Show Last 20 Lines
View Options

sbin/ping/ping.c

Show First 20 Lines • Show All 83 Lines • ▼ Show 20 Linesfirewire_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
struct m_tag *mtag; struct m_tag *mtag;
union fw_encap *enc; union fw_encap *enc;
struct fw_hwaddr *destfw; struct fw_hwaddr *destfw;
uint8_t speed; uint8_t speed;
uint16_t psize, fsize, dsize; uint16_t psize, fsize, dsize;
struct mbuf *mtail; struct mbuf *mtail;
int unicast, dgl, foff; int unicast, dgl, foff;
static int next_dgl; static int next_dgl;
#ifdef INET #if defined(INET) || defined(INET6)
int is_gw; int is_gw = 0;
#endif #endif
#ifdef MAC #ifdef MAC
error = mac_ifnet_check_transmit(ifp, m); error = mac_ifnet_check_transmit(ifp, m);
if (error) if (error)
goto bad; goto bad;
#endif #endif
if (!((ifp->if_flags & IFF_UP) && if (!((ifp->if_flags & IFF_UP) &&
(ifp->if_drv_flags & IFF_DRV_RUNNING))) { (ifp->if_drv_flags & IFF_DRV_RUNNING))) {
error = ENETDOWN; error = ENETDOWN;
goto bad; goto bad;
} }
#if defined(INET) || defined(INET6)
if (ro != NULL && ro->ro_rt != NULL &&
(ro->ro_rt->rt_flags & RTF_GATEWAY) != 0)
is_gw = 1;
#endif
/* /*
* For unicast, we make a tag to store the lladdr of the * For unicast, we make a tag to store the lladdr of the
* destination. This might not be the first time we have seen * destination. This might not be the first time we have seen
* the packet (for instance, the arp code might be trying to * the packet (for instance, the arp code might be trying to
* re-send it after receiving an arp reply) so we only * re-send it after receiving an arp reply) so we only
* allocate a tag if there isn't one there already. For * allocate a tag if there isn't one there already. For
* multicast, we will eventually use a different tag to store * multicast, we will eventually use a different tag to store
* the channel number. * the channel number.
▲ Show 20 Lines • Show All 52 Lines • ▼ Show 20 Lines case AF_ARP:
m_adj(m, -ah->ar_hln); m_adj(m, -ah->ar_hln);
break; break;
} }
#endif #endif
#ifdef INET6 #ifdef INET6
case AF_INET6: case AF_INET6:
if (unicast) { if (unicast) {
error = nd6_storelladdr(fc->fc_ifp, m, dst, error = nd6_resolve(fc->fc_ifp, is_gw, m, dst,
(u_char *) destfw, NULL); (u_char *) destfw, NULL);
if (error) if (error)
return (error); return (error == EWOULDBLOCK ? 0 : error);
} }
type = ETHERTYPE_IPV6; type = ETHERTYPE_IPV6;
break; break;
#endif #endif
default: default:
if_printf(ifp, "can't handle af%d\n", dst->sa_family); if_printf(ifp, "can't handle af%d\n", dst->sa_family);
error = EAFNOSUPPORT; error = EAFNOSUPPORT;
▲ Show 20 Lines • Show All 670 Lines • Show Last 20 Lines
View Options

usr.bin/kdump/kdump.c

Show First 20 Lines • Show All 83 Lines • ▼ Show 20 Linesfirewire_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
struct m_tag *mtag; struct m_tag *mtag;
union fw_encap *enc; union fw_encap *enc;
struct fw_hwaddr *destfw; struct fw_hwaddr *destfw;
uint8_t speed; uint8_t speed;
uint16_t psize, fsize, dsize; uint16_t psize, fsize, dsize;
struct mbuf *mtail; struct mbuf *mtail;
int unicast, dgl, foff; int unicast, dgl, foff;
static int next_dgl; static int next_dgl;
#ifdef INET #if defined(INET) || defined(INET6)
int is_gw; int is_gw = 0;
#endif #endif
#ifdef MAC #ifdef MAC
error = mac_ifnet_check_transmit(ifp, m); error = mac_ifnet_check_transmit(ifp, m);
if (error) if (error)
goto bad; goto bad;
#endif #endif
if (!((ifp->if_flags & IFF_UP) && if (!((ifp->if_flags & IFF_UP) &&
(ifp->if_drv_flags & IFF_DRV_RUNNING))) { (ifp->if_drv_flags & IFF_DRV_RUNNING))) {
error = ENETDOWN; error = ENETDOWN;
goto bad; goto bad;
} }
#if defined(INET) || defined(INET6)
if (ro != NULL && ro->ro_rt != NULL &&
(ro->ro_rt->rt_flags & RTF_GATEWAY) != 0)
is_gw = 1;
#endif
/* /*
* For unicast, we make a tag to store the lladdr of the * For unicast, we make a tag to store the lladdr of the
* destination. This might not be the first time we have seen * destination. This might not be the first time we have seen
* the packet (for instance, the arp code might be trying to * the packet (for instance, the arp code might be trying to
* re-send it after receiving an arp reply) so we only * re-send it after receiving an arp reply) so we only
* allocate a tag if there isn't one there already. For * allocate a tag if there isn't one there already. For
* multicast, we will eventually use a different tag to store * multicast, we will eventually use a different tag to store
* the channel number. * the channel number.
▲ Show 20 Lines • Show All 52 Lines • ▼ Show 20 Lines case AF_ARP:
m_adj(m, -ah->ar_hln); m_adj(m, -ah->ar_hln);
break; break;
} }
#endif #endif
#ifdef INET6 #ifdef INET6
case AF_INET6: case AF_INET6:
if (unicast) { if (unicast) {
error = nd6_storelladdr(fc->fc_ifp, m, dst, error = nd6_resolve(fc->fc_ifp, is_gw, m, dst,
(u_char *) destfw, NULL); (u_char *) destfw, NULL);
if (error) if (error)
return (error); return (error == EWOULDBLOCK ? 0 : error);
} }
type = ETHERTYPE_IPV6; type = ETHERTYPE_IPV6;
break; break;
#endif #endif
default: default:
if_printf(ifp, "can't handle af%d\n", dst->sa_family); if_printf(ifp, "can't handle af%d\n", dst->sa_family);
error = EAFNOSUPPORT; error = EAFNOSUPPORT;
▲ Show 20 Lines • Show All 670 Lines • Show Last 20 Lines