jonathan (Jonathan Anderson)
User

Projects

User Details

User Since
May 9 2014, 10:57 PM (159 w, 3 d)

Recent Activity

Yesterday

jonathan added inline comments to D10826: Document direct execution mode for ld.so..
Mon, May 29, 1:41 PM

Sun, May 28

jonathan accepted D10826: Document direct execution mode for ld.so..

Some very small nits on which I would happily defer (well, except for the spelling one). Otherwise LGTM.

Sun, May 28, 11:40 PM

Thu, May 18

jonathan committed rS318432: Fix some nroff syntax in rtld.1..
Fix some nroff syntax in rtld.1.
Thu, May 18, 12:32 AM

Wed, May 17

jonathan committed rS318431: Allow rtld direct-exec to take a file descriptor..
Allow rtld direct-exec to take a file descriptor.
Wed, May 17, 10:51 PM
jonathan closed D10751: Allow rtld direct-exec to take a file descriptor. by committing rS318431: Allow rtld direct-exec to take a file descriptor..
Wed, May 17, 10:51 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Restore tabs to print_args().
Wed, May 17, 10:35 PM
jonathan added a comment to D10751: Allow rtld direct-exec to take a file descriptor..
In D10751#223329, @kib wrote:

For new functions in rtld, I use normal style(9), so rtld slowly migrates to proper indentation. For smaller changes to existing functions I do follow existing style of 4 spaces indent/2 spaces continuation.

Wed, May 17, 10:31 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Add a missing rtld_strerror()
  • Convert some _rtld_error() calls to rtld_printf().
  • Use four spaces for second-level indent.
  • Be clear about user- vs path-derived descriptor.
Wed, May 17, 9:28 PM
jonathan added inline comments to D10751: Allow rtld direct-exec to take a file descriptor..
Wed, May 17, 9:23 PM
jonathan added inline comments to D10751: Allow rtld direct-exec to take a file descriptor..
Wed, May 17, 9:02 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Remove some superfluous parentheses.
  • Remove redundant fstat(2) call.
Wed, May 17, 9:02 PM
jonathan accepted D10775: Fix shebangs in devel/tesla.

LGTM. I'm also happy to fix this upstream: what should the Python shebang line be instead of #!/usr/bin/env python?

Wed, May 17, 5:21 PM
jonathan added a comment to D10751: Allow rtld direct-exec to take a file descriptor..

Ok, I think I've addressed all of these points now. I suppose that my use of strncmp comes from... my fingers just don't want to type functions that start with strc? :) Anyhow, I've changed all of the strncmp to strcmp and strnlen to strlen as you've asked.

Wed, May 17, 4:36 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Address comments in kib's review.
Wed, May 17, 4:32 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Fix argv/environ/aux shift calculations.
Wed, May 17, 12:02 AM

Tue, May 16

jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Drop unnecessary defensive braces.
Tue, May 16, 10:58 PM
jonathan added a comment to D10751: Allow rtld direct-exec to take a file descriptor..
  • Merge 'origin/master' into arcpatch-D10751
Tue, May 16, 10:56 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Merge 'origin/master' into arcpatch-D10751
Tue, May 16, 10:55 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Apply a style(9) fix.
Tue, May 16, 1:49 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Remove a stray (debug) utrace(2) invocation.
Tue, May 16, 1:47 PM
jonathan updated the diff for D10751: Allow rtld direct-exec to take a file descriptor..
  • Add more explicit argument parsing to rtld.
  • Merge remote-tracking branch 'origin/master' into arcpatch-D10751
Tue, May 16, 1:46 PM
jonathan committed rS318352: Rename rtld's parse_libdir to parse_integer..
Rename rtld's parse_libdir to parse_integer.
Tue, May 16, 1:28 PM
jonathan added a comment to D10751: Allow rtld direct-exec to take a file descriptor..
In D10751#222729, @kib wrote:

I do not like these argv0 tricks, I intend to implement normal options parsing for the direct mode. One of the options would take the file descriptor number and do what your trick does. I think that this is better than the trick since it allows to easily invoke and test the functionality from the shell.

Tue, May 16, 12:33 PM

Mon, May 15

jonathan abandoned D9030: Create new fexecve() variant with explicit interpreter.

I've just opened D10751 as a more rtld-centric way of achieving (hopefully) the same effect, now that D10701 has landed and ld-elf.so.1 is directly executable.

Mon, May 15, 11:38 PM
jonathan updated subscribers of D10751: Allow rtld direct-exec to take a file descriptor..
Mon, May 15, 11:34 PM
jonathan created D10751: Allow rtld direct-exec to take a file descriptor..
Mon, May 15, 11:31 PM
jonathan added a comment to D9030: Create new fexecve() variant with explicit interpreter.
In D9030#222200, @kib wrote:

But important point is that new syscall extends kernel ABI, and by its nature, this change is with us forever. If we start consider the approach wrong and better approach emerges, we still must maintain the syscall, due to the backward compatibility guarantees.

Mon, May 15, 1:16 AM

Sat, May 13

jonathan added a comment to D9030: Create new fexecve() variant with explicit interpreter.
In D9030#221824, @kib wrote:

What is slightly less obvious is how to pass the binary to ld.so, but: ELF format specified a way to run binaries by filedescriptor for long time. Look at the AT_EXECFD aux vector, we still have this code in rtld.c (it might somewhat rotten, but this is easily fixable). Then the standalone-runnable ld.so only needs to grow an option to specify which fd points to the binary, in addition to AT_EXECFD.

Sat, May 13, 5:36 PM
jonathan updated the diff for D9030: Create new fexecve() variant with explicit interpreter.
  • Don't honour setuid/setgid with custom interpreter.
Sat, May 13, 1:40 AM
jonathan updated the diff for D9030: Create new fexecve() variant with explicit interpreter.
  • Don't honour setuid/setgid with custom interpreter.
Sat, May 13, 1:35 AM
jonathan added a comment to D9030: Create new fexecve() variant with explicit interpreter.
In D9030#221740, @kib wrote:

Let's split two things. I thought that your issue at hand was the conflict between the nature of capability mode disallowing implicit root and absolute lookups, badly interfering with the typical absolute path specification for ELF interpreters.

Sat, May 13, 1:28 AM

Fri, May 12

jonathan added a comment to D9030: Create new fexecve() variant with explicit interpreter.
In D9030#221707, @kib wrote:

As is, the thing is unbelievable security hole. Unprivileged user can execute suid binary with arbitrary code injected instead of official interpreter. Even for the static suid binary, it seems. Please correct me.

Fri, May 12, 7:38 PM
jonathan added a comment to D9030: Create new fexecve() variant with explicit interpreter.

FWIW, I'm not a fan of the NULL terminated argv and envv arguments as they make argument validation in CheriABI harder, but I mostly think that ship has sailed. If I were to fix it I'd make the syscall a into a __ffexecve() that takes lengths and have ffexecve() be a user space wrapper that counts the lengths of the vectors and passes them down.

Fri, May 12, 7:24 PM

Thu, May 11

jonathan updated the diff for D9030: Create new fexecve() variant with explicit interpreter.
  • Disable ffexecve(2) with non-ELF image activators.
Thu, May 11, 11:51 PM
jonathan retitled D9030: Create new fexecve() variant with explicit interpreter from First attempt at a new fexecve() variant that allows the interpreter to be specified explicitly with a file descriptor. to Create new fexecve() variant with explicit interpreter.
Thu, May 11, 11:50 PM
jonathan updated the diff for D9030: Create new fexecve() variant with explicit interpreter.
  • Merge 'origin/master' into arcpatch-D9030
  • Add !have_interp for consistency.
  • Rename fldexec to ffexecve.
  • Add ffexecve to execve(2) man page.
Thu, May 11, 1:54 PM

Mar 29 2017

jonathan accepted D10149: DTrace Audit Provider Prototype.

LGTM

Mar 29 2017, 7:51 PM
jonathan added a comment to D10149: DTrace Audit Provider Prototype.

Some of these questions may not make sense to those thoroughly versed in DTrace, but I'm new in this corner of the world. :)

Mar 29 2017, 1:56 AM

Mar 17 2017

jonathan updated the diff for D9030: Create new fexecve() variant with explicit interpreter.
  • Fix MLINKS for fldexec.
Mar 17 2017, 6:13 PM
jonathan updated the diff for D9030: Create new fexecve() variant with explicit interpreter.

Rebase onto -CURRENT

Mar 17 2017, 5:04 PM
jonathan updated the diff for D9030: Create new fexecve() variant with explicit interpreter.
  • Remove auto-generated files from diff.
Mar 17 2017, 4:57 PM

Mar 11 2017

jonathan added inline comments to D9853: Exclude assembly files from LLVM IR Builds.
Mar 11 2017, 3:12 AM

Jan 3 2017

jonathan retitled D9030: Create new fexecve() variant with explicit interpreter from to First attempt at a new fexecve() variant that allows the interpreter to be specified explicitly with a file descriptor..
Jan 3 2017, 2:34 PM

Nov 22 2016

jonathan added a comment to D8397: Add devd rule for Elantech touchscreens..

usbconfig output is here: http://pastebin.com/iqJix3h2

Nov 22 2016, 3:14 PM
jonathan added a reviewer for D8397: Add devd rule for Elantech touchscreens.: hselasky.
Nov 22 2016, 2:41 PM
jonathan added a comment to D8439: New port: devel/llbuild.

I think this might address all of the comments properly now?

Nov 22 2016, 2:32 PM
jonathan updated the diff for D8439: New port: devel/llbuild.
  • New port: devel/llbuild
  • Change post-stage to post-install for docs.
  • Fix typo: "swift-llbuild", not "switch-llbuild"!
  • Add the llbuild binary to the build and plist.
  • Fix licensing: use ports' multi-license support.
Nov 22 2016, 2:31 PM

Nov 10 2016

jonathan added inline comments to D8439: New port: devel/llbuild.
Nov 10 2016, 5:33 PM

Nov 5 2016

jonathan updated the diff for D8439: New port: devel/llbuild.
  • Fix typo: "swift-llbuild", not "switch-llbuild"!
Nov 5 2016, 6:39 AM
jonathan added inline comments to D8439: New port: devel/llbuild.
Nov 5 2016, 6:37 AM
jonathan updated the diff for D8439: New port: devel/llbuild.
  • Change post-stage to post-install for docs.
Nov 5 2016, 6:37 AM

Nov 4 2016

jonathan retitled D8439: New port: devel/llbuild from to New port: devel/llbuild.
Nov 4 2016, 12:34 AM

Nov 1 2016

jonathan committed rS308181: Add rules to build LLVM IR binaries and libraries..
Add rules to build LLVM IR binaries and libraries.
Nov 1 2016, 9:28 PM
jonathan closed D8388: Add rules to build LLVM IR binaries and libraries. by committing rS308181: Add rules to build LLVM IR binaries and libraries..
Nov 1 2016, 9:28 PM
jonathan added a comment to D8388: Add rules to build LLVM IR binaries and libraries..

Thanks for the comments: I think I've managed to address them.

Nov 1 2016, 12:28 AM
jonathan updated the diff for D8388: Add rules to build LLVM IR binaries and libraries..
  • Add {BC,LL}OBJS to bsd.lib.mk's CLEANFILES.
  • Remove redundant C++/non-C++ logic.
  • Improve whitespace consistency.
Nov 1 2016, 12:27 AM

Oct 31 2016

jonathan retitled D8397: Add devd rule for Elantech touchscreens. from to Add devd rule for Elantech touchscreens..
Oct 31 2016, 12:35 PM
jonathan retitled D8388: Add rules to build LLVM IR binaries and libraries. from to Add rules to build LLVM IR binaries and libraries..
Oct 31 2016, 1:42 AM

Oct 24 2016

jonathan added a comment to D8326: Use upstream suffixes for LLVM IR.

The distinction between .bc and .bco was actually purposeful. The next step in the process is to add IR build rules for whole programs, and then we might end up with conflicts between the IR file that's analogous to cp.o and the IR file that's analogous to the cp binary (i.e., the result of llvm-link). So, we used .bco as the bitcode suffix that's analogous to .o (much like .pico is the PIC suffix for .o files).

Oct 24 2016, 1:56 AM

Oct 20 2016

jonathan closed D4339: Add suffix rules for LLVM IR and bitcode. by committing rS307676: Add make rules to build LLVM IR from C/C++ sources..
Oct 20 2016, 3:14 PM
jonathan committed rS307676: Add make rules to build LLVM IR from C/C++ sources..
Add make rules to build LLVM IR from C/C++ sources.
Oct 20 2016, 3:14 PM

Oct 19 2016

jonathan added a comment to D4339: Add suffix rules for LLVM IR and bitcode..

This is a much simpler change after rS307075. How does it look to everyone now?

Oct 19 2016, 11:51 PM

Oct 12 2016

jonathan accepted D8133: abort in srandomdev if kern.arandom sysctl fails.

Looks like a good idea to me. Perhaps it's worthy of a comment explaining why we use abort() within a library? It could contain the same text as at the top of this review, but it might be a slightly surprising thing to discover if you haven't been party to the review.

Oct 12 2016, 1:27 AM
jonathan updated the diff for D4339: Add suffix rules for LLVM IR and bitcode..

Rework this change based on rS307075 (suffix rule files).

Oct 12 2016, 1:22 AM
jonathan committed rS307075: Extract suffix rules into bsd.suffixes[-posix].mk..
Extract suffix rules into bsd.suffixes[-posix].mk.
Oct 12 2016, 12:43 AM
jonathan closed D6805: Extract suffix rules into bsd.suffixes[-posix].mk. by committing rS307075: Extract suffix rules into bsd.suffixes[-posix].mk..
Oct 12 2016, 12:43 AM

Oct 11 2016

jonathan updated the diff for D6805: Extract suffix rules into bsd.suffixes[-posix].mk..
  • Merge 'origin/master' into arcpatch-D6805
Oct 11 2016, 7:34 PM

Oct 7 2016

jonathan added a comment to D8110: Allow some dotdot lookups in capability mode..

A fairly cursory look didn't turn up any obvious problems for me, but I would like to take a deeper look over the next few days.

Oct 7 2016, 1:23 AM · capsicum
jonathan abandoned D8127: Build with GUI enabled by default..

Thanks for responding... sounds like a tough problem until we make the leap to Python 3.

Oct 7 2016, 1:06 AM

Oct 6 2016

jonathan added a comment to D6805: Extract suffix rules into bsd.suffixes[-posix].mk..

Indeed, I did have that exp-run done:
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=210331

Oct 6 2016, 1:41 AM
jonathan added a comment to D6805: Extract suffix rules into bsd.suffixes[-posix].mk..

Not that we're well clear of code freezes on -CURRENT (and I think that I've addressed @bdrewery's comments), are folks ok with me committing this?

Oct 6 2016, 12:37 AM

Oct 3 2016

jonathan accepted D8077: libc arc4_stir: use only kern.arandom sysctl.

Very nice.

Oct 3 2016, 1:05 PM
jonathan added a watcher for DTrace: jonathan.
Oct 3 2016, 12:54 AM
jonathan added a watcher for chromium: jonathan.
Oct 3 2016, 12:53 AM
jonathan accepted D1345: Capsicum support for jot(1).

LGTM

Oct 3 2016, 12:52 AM
jonathan accepted D8076: Capsicum-ize lam(1).

Looks good to me in principle; see inline comment above.

Oct 3 2016, 12:48 AM
jonathan retitled D8127: Build with GUI enabled by default. from to Build with GUI enabled by default..
Oct 3 2016, 12:37 AM

Sep 30 2016

jonathan added a reviewer for D8013: Capsicum helpers: jonathan.
Sep 30 2016, 2:19 PM

Sep 27 2016

jonathan retitled D8043: Patch vimdot to use /usr/local from to Patch vimdot to use /usr/local.
Sep 27 2016, 12:27 AM

Sep 26 2016

jonathan added a reviewer for D8015: Make kern.hostname and friends readable in capability mode: rwatson.
Sep 26 2016, 5:21 PM
jonathan accepted D8015: Make kern.hostname and friends readable in capability mode.

I think that these are all fine to make readable, for the same reason that the hostname is ok: allowing information to "leak" in a way that enables more software to use Capsicum sandboxing is a net win. If we wanted to obscure the host UUID then we should also be hiding anything that could be used to identify the machine, which seems distinctly unhelpful in our overall goal of World Domination (tm).

Sep 26 2016, 5:21 PM
jonathan accepted D8000: kern_mib: Allow kern.hostname in Capsicum capability sandbox.

I'm fine with exposing the hostname here -- the goal of Capsicum has always been to be pragmatic about getting software running where it doesn't violate isolation properties. You could argue that this is an information leak and/or might cause problems for deterministic replay-style applications of Capsicum -- but I'd rather we had more code working in a sandboxing. :-)

Sep 26 2016, 5:14 PM

Sep 22 2016

jonathan closed D7879: Switch libpololu-avr port to GitHub sources. by committing rP422600: Switch libpololu-avr port to GitHub sources..
Sep 22 2016, 11:19 AM
jonathan committed rP422600: Switch libpololu-avr port to GitHub sources..
Switch libpololu-avr port to GitHub sources.
Sep 22 2016, 11:19 AM
jonathan committed rP422599: New port: devel/libgrading Library for grading C/C++ assignments.
New port: devel/libgrading Library for grading C/C++ assignments
Sep 22 2016, 11:15 AM
jonathan closed D7956: Add a new port devel/libgrading. by committing rP422599: New port: devel/libgrading Library for grading C/C++ assignments.
Sep 22 2016, 11:15 AM

Sep 21 2016

jonathan accepted D7724: Copy capabilities to new fd after accept(2)..

Agreed: this change makes perfect sense to me after rS305756.

Sep 21 2016, 7:27 PM
jonathan updated the diff for D7879: Switch libpololu-avr port to GitHub sources..
  • Simplify {BUILD,RUN}_DEPENDS.
Sep 21 2016, 7:21 PM
jonathan added inline comments to D7956: Add a new port devel/libgrading..
Sep 21 2016, 7:11 PM
jonathan updated the diff for D7956: Add a new port devel/libgrading..
  • Remove superfluous GH_PROJECT variable.
  • Move GitHub details to below LIB_DEPENDS.
  • Clean up COMMENT to satisfy portlint -A.
  • Change pkg-plist to PLIST_FILES.
Sep 21 2016, 7:10 PM

Sep 19 2016

jonathan added a comment to D7734: First pass at capsicumizing file(1).

I think I'd be more comfortable if the bug fixes were committed separately from the Capsicum changes (making everything easier to upstream?) and if the Capsicum-specific stuff could be refactored out as much as possible to reduce the in-line #ifdef content. In particular, it would be nice if there could be struct sandbox or the like to capture all of the additional state required by Capsicum, and the contents of that structure could be different on FreeBSD, OpenBSD, etc. If there were a function called start_sandbox(struct sandbox *sbp) or the like, possibly together with a set_flags(int fd, struct sandbox *) or something, it would allow a nice, fair comparison between the Capsicum and Pledge LoC.

Sep 19 2016, 9:37 PM
jonathan added a comment to D7773: Capsicum-ize brandelf.
In D7773#164148, @cem wrote:

I'm not a fan of introducing additional forks into otherwise straightforward programs. I think we might introduce more bugs that way than we mitigate with capsicum. I'd rather just allocate a list or array and preopen all inputs.

Sep 19 2016, 9:29 PM
jonathan retitled D7956: Add a new port devel/libgrading. from to Add a new port devel/libgrading..
Sep 19 2016, 7:02 PM
jonathan added a comment to D7879: Switch libpololu-avr port to GitHub sources..

Updated port to Fix All The Things (TM)

Sep 19 2016, 4:54 PM
jonathan updated the diff for D7879: Switch libpololu-avr port to GitHub sources..
  • Remove PREFIX hack from libpolou-avr.
  • Add RUN_DEPENDS to libpololu-avr.
Sep 19 2016, 4:53 PM

Sep 13 2016

jonathan added inline comments to D7879: Switch libpololu-avr port to GitHub sources..
Sep 13 2016, 4:49 PM
jonathan added inline comments to D7879: Switch libpololu-avr port to GitHub sources..
Sep 13 2016, 4:42 PM
jonathan added a reviewer for D7879: Switch libpololu-avr port to GitHub sources.: portmgr.
Sep 13 2016, 2:19 PM
jonathan retitled D7879: Switch libpololu-avr port to GitHub sources. from to Switch libpololu-avr port to GitHub sources..
Sep 13 2016, 2:16 PM

Sep 1 2016

jonathan edited this Badge.
Sep 1 2016, 3:02 PM