summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_sig.c
Commit message (Collapse)AuthorAgeFilesLines
* MFC r304440, r304487:markj2016-08-221-1/+1
| | | | Fix some handling of P2_PTRACE_FSTP.
* MFC r303423:kib2016-08-151-9/+37
| | | | Force SIGSTOP to be the first signal reported after the attach.
* MFC 302900,302902,302921,303461,304009:jhb2016-08-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a mask of optional ptrace() events. 302900: Add a test for user signal delivery. This test verifies we get the correct ptrace event details when a signal is posted to a traced process from userland. 302902: Add a mask of optional ptrace() events. ptrace() now stores a mask of optional events in p_ptevents. Currently this mask is a single integer, but it can be expanded into an array of integers in the future. Two new ptrace requests can be used to manipulate the event mask: PT_GET_EVENT_MASK fetches the current event mask and PT_SET_EVENT_MASK sets the current event mask. The current set of events include: - PTRACE_EXEC: trace calls to execve(). - PTRACE_SCE: trace system call entries. - PTRACE_SCX: trace syscam call exits. - PTRACE_FORK: trace forks and auto-attach to new child processes. - PTRACE_LWP: trace LWP events. The S_PT_SCX and S_PT_SCE events in the procfs p_stops flags have been replaced by PTRACE_SCE and PTRACE_SCX. PTRACE_FORK replaces P_FOLLOW_FORK and PTRACE_LWP replaces P2_LWP_EVENTS. The PT_FOLLOW_FORK and PT_LWP_EVENTS ptrace requests remain for compatibility but now simply toggle corresponding flags in the event mask. While here, document that PT_SYSCALL, PT_TO_SCE, and PT_TO_SCX both modify the event mask and continue the traced process. 302921: Rename PTRACE_SYSCALL to LINUX_PTRACE_SYSCALL. 303461: Note that not all optional ptrace events use SIGTRAP. New child processes attached due to PTRACE_FORK use SIGSTOP instead of SIGTRAP. All other ptrace events use SIGTRAP. 304009: Remove description of P_FOLLOWFORK as this flag was removed.
* MFC 292894,292896: Add ptrace(2) reporting for LWP events.jhb2016-08-121-1/+6
| | | | | | | | | | | | | | 292894: Add ptrace(2) reporting for LWP events. Add two new LWPINFO flags: PL_FLAG_BORN and PL_FLAG_EXITED for reporting thread creation and destruction. Newly created threads will stop to report PL_FLAG_BORN before returning to userland and exiting threads will stop to report PL_FLAG_EXIT before exiting completely. Both of these events are only enabled and reported if PT_LWP_EVENTS is enabled on a process. 292896: Document the recently added support for ptrace(2) LWP events.
* MFC r292384:bdrewery2016-06-271-8/+8
| | | | | | Fix style issues around existing SDT probes. ** Changes to sys/netinet/in_kdtrace.c and sys/netinet/in_kdtrace.h skipped.
* MFC r288336: save some bytes by using more concise SDT_PROBE<n>avg2015-10-231-3/+3
|
* MFC 283546:jhb2015-06-131-0/+2
| | | | Add KTR tracing for some MI ptrace events.
* MFC r283745:kib2015-06-051-3/+6
| | | | Do not raise priority of the idle thread on singal delivery.
* Merge r263233 from HEAD to stable/10:rwatson2015-03-191-1/+1
| | | | | | | | | Update kernel inclusions of capability.h to use capsicum.h instead; some further refinement is required as some device drivers intended to be portable over FreeBSD versions rely on __FreeBSD_version to decide whether to include capability.h. Sponsored by: Google, Inc.
* MFC r277322:kib2015-01-251-1/+2
| | | | | Add procctl(2) PROC_TRACE_CTL command to enable or disable debugger attachment to the process.
* MFC r277321:kib2015-01-251-2/+5
| | | | | Make SIGSTOP working for sleeps done while waiting for fifo readers or writers in open(2), when the fifo is located on an NFS mount.
* MFC r277236:kib2015-01-221-3/+4
| | | | | For sigaction(2), ignore possible garbage in sa_flags for sa_handler == SIG_DFL or SIG_IGN.
* MFC r276008:kib2015-01-041-1/+2
| | | | | Add VN_OPEN_NAMECACHE flag for vn_open_cred(9), which requests that the created file name was cached. Use the flag for core dumps.
* MFC r275745:kib2014-12-271-3/+3
| | | | | | | | | | Add facility to stop all userspace processes. MFC r275753: Fix gcc build. MFC r275820: Add missed break.
* MFC r275206:kib2014-12-051-2/+8
| | | | | Assert the state of the process lock and sigact mutex in kern_sigprocmask() and reschedule_signals().
* MFC r275120:kib2014-12-031-19/+27
| | | | | Fix SA_SIGINFO | SA_RESETHAND handling, reset disposition after sv_sendsig() is called.
* MFC r270321:kib2014-08-291-33/+44
| | | | | | | | | Ensure that sigaction flags for signal, which disposition is reset to ignored or default, are not leaking. MFC r270504: Revert the handling of all siginfo sa_flags except SA_SIGINFO to the pre-r270321 state.
* MFC r270320:kib2014-08-291-0/+4
| | | | | Check the validity of struct sigaction sa_flags value, reject unknown flags.
* MFC r268634:mjg2014-08-171-10/+7
| | | | Manage struct sigacts refcnt with atomics instead of a mutex.
* MFC r268074:mjg2014-08-171-5/+1
| | | | | | | | | | Perform a lockless check in sigacts_shared. It is used only during execve (i.e. singlethreaded), so there is no fear of returning 'not shared' which soon becomes 'shared'. While here reorganize the code a little to avoid proc lock/unlock in shared case.
* MFC r258622: dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINEavg2014-01-171-6/+6
|
* MFC r258281: Fix siginfo_t.si_status for wait6/waitid/SIGCHLD.jilles2014-01-011-8/+11
| | | | | | | | | | | | | Per POSIX, si_status should contain the value passed to exit() for si_code==CLD_EXITED and the signal number for other si_code. This was incorrect for CLD_EXITED and CLD_DUMPED. This is still not fully POSIX-compliant (Austin group issue #594 says that the full value passed to exit() shall be returned via si_status, not just the low 8 bits) but is sufficient for a si_status-related test in libnih (upstart, Debian/kFreeBSD). PR: kern/184002
* Change the cap_rights_t type from uint64_t to a structure that we can extendpjd2013-09-051-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the future in a backward compatible (API and ABI) way. The cap_rights_t represents capability rights. We used to use one bit to represent one right, but we are running out of spare bits. Currently the new structure provides place for 114 rights (so 50 more than the previous cap_rights_t), but it is possible to grow the structure to hold at least 285 rights, although we can make it even larger if 285 rights won't be enough. The structure definition looks like this: struct cap_rights { uint64_t cr_rights[CAP_RIGHTS_VERSION + 2]; }; The initial CAP_RIGHTS_VERSION is 0. The top two bits in the first element of the cr_rights[] array contain total number of elements in the array - 2. This means if those two bits are equal to 0, we have 2 array elements. The top two bits in all remaining array elements should be 0. The next five bits in all array elements contain array index. Only one bit is used and bit position in this five-bits range defines array index. This means there can be at most five array elements in the future. To define new right the CAPRIGHT() macro must be used. The macro takes two arguments - an array index and a bit to set, eg. #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL) We still support aliases that combine few rights, but the rights have to belong to the same array element, eg: #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL) #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL) #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP) There is new API to manage the new cap_rights_t structure: cap_rights_t *cap_rights_init(cap_rights_t *rights, ...); void cap_rights_set(cap_rights_t *rights, ...); void cap_rights_clear(cap_rights_t *rights, ...); bool cap_rights_is_set(const cap_rights_t *rights, ...); bool cap_rights_is_valid(const cap_rights_t *rights); void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src); void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src); bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little); Capability rights to the cap_rights_init(), cap_rights_set(), cap_rights_clear() and cap_rights_is_set() functions are provided by separating them with commas, eg: cap_rights_t rights; cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT); There is no need to terminate the list of rights, as those functions are actually macros that take care of the termination, eg: #define cap_rights_set(rights, ...) \ __cap_rights_set((rights), __VA_ARGS__, 0ULL) void __cap_rights_set(cap_rights_t *rights, ...); Thanks to using one bit as an array index we can assert in those functions that there are no two rights belonging to different array elements provided together. For example this is illegal and will be detected, because CAP_LOOKUP belongs to element 0 and CAP_PDKILL to element 1: cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL); Providing several rights that belongs to the same array's element this way is correct, but is not advised. It should only be used for aliases definition. This commit also breaks compatibility with some existing Capsicum system calls, but I see no other way to do that. This should be fine as Capsicum is still experimental and this change is not going to 9.x. Sponsored by: The FreeBSD Foundation
* Specify SDT probe argument types in the probe definition itself rather thanmarkj2013-08-151-11/+6
| | | | | | | | | using SDT_PROBE_ARGTYPE(). This will make it easy to extend the SDT(9) API to allow probes with dynamically-translated types. There is no functional change. MFC after: 2 weeks
* Remove duplicate assertion from tdsendsignal.mjg2013-07-221-3/+1
| | | | MFC after: 2 weeks
* Fix memory leak in coredump().glebius2013-04-051-0/+1
| | | | Reviewed by: kib
* Tweak some comments.jhb2013-03-181-4/+4
|
* Partially revert r195702. Deferring stops is now implemented via a set ofjhb2013-03-181-12/+6
| | | | | | | | calls to toggle TDF_SBDRY rather than passing PBDRY to individual sleep calls. - Remove the stop_allowed parameters from cursig() and issignal(). issignal() checks TDF_SBDRY directly. - Remove the PBDRY and SLEEPQ_STOP_ON_BDRY flags.
* Further refine the handling of stop signals in the NFS client. Thejhb2013-02-211-8/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | changes in r246417 were incomplete as they did not add explicit calls to sigdeferstop() around all the places that previously passed SBDRY to _sleep(). In addition, nfs_getcacheblk() could trigger a write RPC from getblk() resulting in sigdeferstop() recursing. Rather than manually deferring stop signals in specific places, change the VFS_*() and VOP_*() methods to defer stop signals for filesystems which request this behavior via a new VFCF_SBDRY flag. Note that this has to be a VFC flag rather than a MNTK flag so that it works properly with VFS_MOUNT() when the mount is not yet fully constructed. For now, only the NFS clients are set this new flag in VFS_SET(). A few other related changes: - Add an assertion to ensure that TDF_SBDRY doesn't leak to userland. - When a lookup request uses VOP_READLINK() to follow a symlink, mark the request as being on behalf of the thread performing the lookup (cnp_thread) rather than using a NULL thread pointer. This causes NFS to properly handle signals during this VOP on an interruptible mount. PR: kern/176179 Reported by: Russell Cattelan (sigdeferstop() recursion) Reviewed by: kib MFC after: 1 month
* Add break to the default case.pjd2013-02-171-0/+1
|
* When vforked child is traced, the debugging events are not generatedkib2013-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | until child performs exec(). The behaviour is reasonable when a debugger is the real parent, because the parent is stopped until exec(), and sending a debugging event to the debugger would deadlock both parent and child. On the other hand, when debugger is not the parent of the vforked child, not sending debugging signals makes it impossible to debug across vfork. Fix the issue by declining generating debug signals only when vfork() was done and child called ptrace(PT_TRACEME). Set a new process flag P_PPTRACE from the attach code for PT_TRACEME, if P_PPWAIT flag is set, which indicates that the process was created with vfork() and still did not execed. Check P_PPTRACE from issignal(), instead of refusing the trace outright for the P_PPWAIT case. The scope of P_PPTRACE is exactly contained in the scope of P_PPWAIT. Found and tested by: zont Reviewed by: pluknet MFC after: 2 weeks
* Rework the handling of stop signals in the NFS client. The changes injhb2013-02-061-11/+43
| | | | | | | | | | | | | | | | | | | | | | | | | 195702, 195703, and 195821 prevented a thread from suspending while holding locks inside of NFS by forcing the thread to fail sleeps with EINTR or ERESTART but defer the thread suspension to the user boundary. However, this had the effect that stopping a process during an NFS request could abort the request and trigger EINTR errors that were visible to userland processes (previously the thread would have suspended and completed the request once it was resumed). This change instead effectively masks stop signals while in the NFS client. It uses the existing TDF_SBDRY flag to effect this since SIGSTOP cannot be masked directly. Also, instead of setting PBDRY on individual sleeps, the NFS client now sets the TDF_SBDRY flag around each NFS request and stop signals are masked for all sleeps during that region (the previous change missed sleeps in lockmgr locks). The end result is that stop signals sent to threads performing an NFS request are completely ignored until after the NFS request has finished processing and the thread prepares to return to userland. This restores the behavior of stop signals being transparent to userland processes while still preventing threads from suspending while holding NFS locks. Reviewed by: kib MFC after: 1 month
* Replace expand_name() function with corefile_open() function, which notpjd2012-12-191-54/+35
| | | | | | | | | only returns name, but also vnode of corefile to use. This simplifies the code and closes few races, especially in %I handling. Reviewed by: kib Obtained from: WHEEL Systems
* Use correct file permissions when looking for available core file ifpjd2012-12-191-1/+1
| | | | | | kern.corefile contains %I. Obtained from: WHEEL Systems
* The 'flags' argument can be modified in vn_open_cred(), so we need topjd2012-12-191-1/+1
| | | | | | set it for every loop interation. Pointed out by: kib
* Do not audit paths we try when kern.corefile contains %I.pjd2012-12-191-1/+2
| | | | Obtained from: WHEEL Systems
* Style cleanups.pjd2012-12-191-50/+48
|
* The expand_name() function isn't called with the process lock held anymore,pjd2012-12-191-14/+2
| | | | | | so we can safely use malloc(M_WAITOK) now. Pointed out by: kib
* Minor style tweaks.pjd2012-12-171-6/+5
| | | | Obtained from: WHEEL Systems
* Better variables naming in expand_name() to be more consistent with coredump().pjd2012-12-171-16/+16
| | | | Obtained from: WHEEL Systems
* Move expand_name() after process lock is released.pjd2012-12-161-7/+4
| | | | | | | | | | This fixed panic where we hold mutex (process lock) and try to obtain sleepable lock (vnode lock in expand_name()). The panic could occur when %I was used in kern.corefile. Additionally we avoid expand_name() overhead when coredumps are disabled. Obtained from: WHEEL Systems
* Don't add audit record when coredumps are disabled or name cannot be expanded.pjd2012-12-161-9/+0
| | | | | Discussed with: rwatson Obtained from: WHEEL Systems
* Make the check easier to read.pjd2012-12-161-2/+1
| | | | Obtained from: WHEEL Systems
* Use 'cred' variable.pjd2012-12-161-2/+1
| | | | Obtained from: WHEEL Systems
* Add kern.capmode_coredump sysctl/tunable to allow processes in capability modepjd2012-11-271-2/+13
| | | | | | | | to dump core. Reviewed by: rwatson Obtained from: WHEEL Systems MFC after: 2 weeks
* Allow to use kill(2) in capability mode, but process can send a signal onlypjd2012-11-271-0/+8
| | | | | | | | | to himself. For example abort(3) at first tries to do kill(getpid(), SIGABRT) which was failing in capability mode, so the code was failing back to exit(1). Reviewed by: rwatson Obtained from: WHEEL Systems MFC after: 2 weeks
* Allow to modify kern.sugid_coredump and kern.corefile from loader.conf.pjd2012-11-271-0/+2
| | | | Obtained from: WHEEL Systems
* More style fixes.pjd2012-11-271-4/+4
|
* Style fixes (mostly whitespaces).pjd2012-11-271-35/+39
|
* Remove the support for using non-mpsafe filesystem modules.kib2012-10-221-9/+2
| | | | | | | | | | | | In particular, do not lock Giant conditionally when calling into the filesystem module, remove the VFS_LOCK_GIANT() and related macros. Stop handling buffers belonging to non-mpsafe filesystems. The VFS_VERSION is bumped to indicate the interface change which does not result in the interface signatures changes. Conducted and reviewed by: attilio Tested by: pho
OpenPOWER on IntegriCloud