summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_sig.c
Commit message (Collapse)AuthorAgeFilesLines
* MFC r258622: dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINEavg2014-01-171-6/+6
|
* MFC r258281: Fix siginfo_t.si_status for wait6/waitid/SIGCHLD.jilles2014-01-011-8/+11
| | | | | | | | | | | | | Per POSIX, si_status should contain the value passed to exit() for si_code==CLD_EXITED and the signal number for other si_code. This was incorrect for CLD_EXITED and CLD_DUMPED. This is still not fully POSIX-compliant (Austin group issue #594 says that the full value passed to exit() shall be returned via si_status, not just the low 8 bits) but is sufficient for a si_status-related test in libnih (upstart, Debian/kFreeBSD). PR: kern/184002
* Change the cap_rights_t type from uint64_t to a structure that we can extendpjd2013-09-051-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the future in a backward compatible (API and ABI) way. The cap_rights_t represents capability rights. We used to use one bit to represent one right, but we are running out of spare bits. Currently the new structure provides place for 114 rights (so 50 more than the previous cap_rights_t), but it is possible to grow the structure to hold at least 285 rights, although we can make it even larger if 285 rights won't be enough. The structure definition looks like this: struct cap_rights { uint64_t cr_rights[CAP_RIGHTS_VERSION + 2]; }; The initial CAP_RIGHTS_VERSION is 0. The top two bits in the first element of the cr_rights[] array contain total number of elements in the array - 2. This means if those two bits are equal to 0, we have 2 array elements. The top two bits in all remaining array elements should be 0. The next five bits in all array elements contain array index. Only one bit is used and bit position in this five-bits range defines array index. This means there can be at most five array elements in the future. To define new right the CAPRIGHT() macro must be used. The macro takes two arguments - an array index and a bit to set, eg. #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL) We still support aliases that combine few rights, but the rights have to belong to the same array element, eg: #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL) #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL) #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP) There is new API to manage the new cap_rights_t structure: cap_rights_t *cap_rights_init(cap_rights_t *rights, ...); void cap_rights_set(cap_rights_t *rights, ...); void cap_rights_clear(cap_rights_t *rights, ...); bool cap_rights_is_set(const cap_rights_t *rights, ...); bool cap_rights_is_valid(const cap_rights_t *rights); void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src); void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src); bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little); Capability rights to the cap_rights_init(), cap_rights_set(), cap_rights_clear() and cap_rights_is_set() functions are provided by separating them with commas, eg: cap_rights_t rights; cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT); There is no need to terminate the list of rights, as those functions are actually macros that take care of the termination, eg: #define cap_rights_set(rights, ...) \ __cap_rights_set((rights), __VA_ARGS__, 0ULL) void __cap_rights_set(cap_rights_t *rights, ...); Thanks to using one bit as an array index we can assert in those functions that there are no two rights belonging to different array elements provided together. For example this is illegal and will be detected, because CAP_LOOKUP belongs to element 0 and CAP_PDKILL to element 1: cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL); Providing several rights that belongs to the same array's element this way is correct, but is not advised. It should only be used for aliases definition. This commit also breaks compatibility with some existing Capsicum system calls, but I see no other way to do that. This should be fine as Capsicum is still experimental and this change is not going to 9.x. Sponsored by: The FreeBSD Foundation
* Specify SDT probe argument types in the probe definition itself rather thanmarkj2013-08-151-11/+6
| | | | | | | | | using SDT_PROBE_ARGTYPE(). This will make it easy to extend the SDT(9) API to allow probes with dynamically-translated types. There is no functional change. MFC after: 2 weeks
* Remove duplicate assertion from tdsendsignal.mjg2013-07-221-3/+1
| | | | MFC after: 2 weeks
* Fix memory leak in coredump().glebius2013-04-051-0/+1
| | | | Reviewed by: kib
* Tweak some comments.jhb2013-03-181-4/+4
|
* Partially revert r195702. Deferring stops is now implemented via a set ofjhb2013-03-181-12/+6
| | | | | | | | calls to toggle TDF_SBDRY rather than passing PBDRY to individual sleep calls. - Remove the stop_allowed parameters from cursig() and issignal(). issignal() checks TDF_SBDRY directly. - Remove the PBDRY and SLEEPQ_STOP_ON_BDRY flags.
* Further refine the handling of stop signals in the NFS client. Thejhb2013-02-211-8/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | changes in r246417 were incomplete as they did not add explicit calls to sigdeferstop() around all the places that previously passed SBDRY to _sleep(). In addition, nfs_getcacheblk() could trigger a write RPC from getblk() resulting in sigdeferstop() recursing. Rather than manually deferring stop signals in specific places, change the VFS_*() and VOP_*() methods to defer stop signals for filesystems which request this behavior via a new VFCF_SBDRY flag. Note that this has to be a VFC flag rather than a MNTK flag so that it works properly with VFS_MOUNT() when the mount is not yet fully constructed. For now, only the NFS clients are set this new flag in VFS_SET(). A few other related changes: - Add an assertion to ensure that TDF_SBDRY doesn't leak to userland. - When a lookup request uses VOP_READLINK() to follow a symlink, mark the request as being on behalf of the thread performing the lookup (cnp_thread) rather than using a NULL thread pointer. This causes NFS to properly handle signals during this VOP on an interruptible mount. PR: kern/176179 Reported by: Russell Cattelan (sigdeferstop() recursion) Reviewed by: kib MFC after: 1 month
* Add break to the default case.pjd2013-02-171-0/+1
|
* When vforked child is traced, the debugging events are not generatedkib2013-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | until child performs exec(). The behaviour is reasonable when a debugger is the real parent, because the parent is stopped until exec(), and sending a debugging event to the debugger would deadlock both parent and child. On the other hand, when debugger is not the parent of the vforked child, not sending debugging signals makes it impossible to debug across vfork. Fix the issue by declining generating debug signals only when vfork() was done and child called ptrace(PT_TRACEME). Set a new process flag P_PPTRACE from the attach code for PT_TRACEME, if P_PPWAIT flag is set, which indicates that the process was created with vfork() and still did not execed. Check P_PPTRACE from issignal(), instead of refusing the trace outright for the P_PPWAIT case. The scope of P_PPTRACE is exactly contained in the scope of P_PPWAIT. Found and tested by: zont Reviewed by: pluknet MFC after: 2 weeks
* Rework the handling of stop signals in the NFS client. The changes injhb2013-02-061-11/+43
| | | | | | | | | | | | | | | | | | | | | | | | | 195702, 195703, and 195821 prevented a thread from suspending while holding locks inside of NFS by forcing the thread to fail sleeps with EINTR or ERESTART but defer the thread suspension to the user boundary. However, this had the effect that stopping a process during an NFS request could abort the request and trigger EINTR errors that were visible to userland processes (previously the thread would have suspended and completed the request once it was resumed). This change instead effectively masks stop signals while in the NFS client. It uses the existing TDF_SBDRY flag to effect this since SIGSTOP cannot be masked directly. Also, instead of setting PBDRY on individual sleeps, the NFS client now sets the TDF_SBDRY flag around each NFS request and stop signals are masked for all sleeps during that region (the previous change missed sleeps in lockmgr locks). The end result is that stop signals sent to threads performing an NFS request are completely ignored until after the NFS request has finished processing and the thread prepares to return to userland. This restores the behavior of stop signals being transparent to userland processes while still preventing threads from suspending while holding NFS locks. Reviewed by: kib MFC after: 1 month
* Replace expand_name() function with corefile_open() function, which notpjd2012-12-191-54/+35
| | | | | | | | | only returns name, but also vnode of corefile to use. This simplifies the code and closes few races, especially in %I handling. Reviewed by: kib Obtained from: WHEEL Systems
* Use correct file permissions when looking for available core file ifpjd2012-12-191-1/+1
| | | | | | kern.corefile contains %I. Obtained from: WHEEL Systems
* The 'flags' argument can be modified in vn_open_cred(), so we need topjd2012-12-191-1/+1
| | | | | | set it for every loop interation. Pointed out by: kib
* Do not audit paths we try when kern.corefile contains %I.pjd2012-12-191-1/+2
| | | | Obtained from: WHEEL Systems
* Style cleanups.pjd2012-12-191-50/+48
|
* The expand_name() function isn't called with the process lock held anymore,pjd2012-12-191-14/+2
| | | | | | so we can safely use malloc(M_WAITOK) now. Pointed out by: kib
* Minor style tweaks.pjd2012-12-171-6/+5
| | | | Obtained from: WHEEL Systems
* Better variables naming in expand_name() to be more consistent with coredump().pjd2012-12-171-16/+16
| | | | Obtained from: WHEEL Systems
* Move expand_name() after process lock is released.pjd2012-12-161-7/+4
| | | | | | | | | | This fixed panic where we hold mutex (process lock) and try to obtain sleepable lock (vnode lock in expand_name()). The panic could occur when %I was used in kern.corefile. Additionally we avoid expand_name() overhead when coredumps are disabled. Obtained from: WHEEL Systems
* Don't add audit record when coredumps are disabled or name cannot be expanded.pjd2012-12-161-9/+0
| | | | | Discussed with: rwatson Obtained from: WHEEL Systems
* Make the check easier to read.pjd2012-12-161-2/+1
| | | | Obtained from: WHEEL Systems
* Use 'cred' variable.pjd2012-12-161-2/+1
| | | | Obtained from: WHEEL Systems
* Add kern.capmode_coredump sysctl/tunable to allow processes in capability modepjd2012-11-271-2/+13
| | | | | | | | to dump core. Reviewed by: rwatson Obtained from: WHEEL Systems MFC after: 2 weeks
* Allow to use kill(2) in capability mode, but process can send a signal onlypjd2012-11-271-0/+8
| | | | | | | | | to himself. For example abort(3) at first tries to do kill(getpid(), SIGABRT) which was failing in capability mode, so the code was failing back to exit(1). Reviewed by: rwatson Obtained from: WHEEL Systems MFC after: 2 weeks
* Allow to modify kern.sugid_coredump and kern.corefile from loader.conf.pjd2012-11-271-0/+2
| | | | Obtained from: WHEEL Systems
* More style fixes.pjd2012-11-271-4/+4
|
* Style fixes (mostly whitespaces).pjd2012-11-271-35/+39
|
* Remove the support for using non-mpsafe filesystem modules.kib2012-10-221-9/+2
| | | | | | | | | | | | In particular, do not lock Giant conditionally when calling into the filesystem module, remove the VFS_LOCK_GIANT() and related macros. Stop handling buffers belonging to non-mpsafe filesystems. The VFS_VERSION is bumped to indicate the interface change which does not result in the interface signatures changes. Conducted and reviewed by: attilio Tested by: pho
* Correct the killpg(2) return values:eadler2012-10-221-6/+14
| | | | | | | | | | | Return EPERM if processes were found but they were unable to be signaled. Return the first error from p_cansignal if no signal was successful. Reviewed by: jilles Approved by: cperciva MFC after: 1 week
* Colin acked the wrong diff originally. fixed version coming soon.eadler2012-10-221-15/+6
| | | | Approved by: cperciva (implicit)
* Correct the killpg(2) return values:eadler2012-10-221-6/+15
| | | | | | | | | | | Return EPERM if processes were found but they were unable to be signaled. Return the first error from p_cansignal if no signal was successful. Reviewed by: jilles Approved by: cperciva MFC after: 1 week
* Ignore stop and continue signals sent to an exiting process. Stop signalsjhb2012-09-131-2/+5
| | | | | | | | | | | set p_xstat to the signal that triggered the stop, but p_xstat is also used to hold the exit status of an exiting process. Without this change, a stop signal that arrived after a process was marked P_WEXIT but before it was marked a zombie would overwrite the exit status with the stop signal number. Reviewed by: kib MFC after: 1 week
* Deliver SIGSYS to the guilty thread, not to the process.kib2012-08-181-1/+1
| | | | MFC after: 1 week
* Always clear p_xthread if current thread no longer needs it, in theory, ifdavidxu2012-07-101-2/+3
| | | | | | | debugger exited without calling ptrace(PT_DETACH), there is a time window that the p_xthread may be pointing to non-existing thread, in practical, this is not a problem because child process soon will be killed by parent process.
* Add thread-private flag to indicate that error value is already placedkib2012-04-121-0/+2
| | | | | | | | | | | | in td_errno. Flag is supposed to be used by syscalls returning EJUSTRETURN because errno was already placed into the usermode frame by a call to set_syscall_retval(9). Both ktrace and dtrace get errno value from td_errno if the flag is set. Use the flag to fix sigsuspend(2) error return ktrace records. Requested by: bde MFC after: 1 week
* Remove unused and wrong SA_PROC internal signal property.jilles2012-04-091-23/+22
| | | | | | | The SA_PROC signal property indicated whether each signal number is directed at a specific thread or at the process in general. However, that depends on how the signal was generated and not on the signal number. SA_PROC was not used.
* Mark all SYSCTL_NODEs static that have no corresponding SYSCTL_DECLs.ed2011-11-071-1/+2
| | | | | | The SYSCTL_NODE macro defines a list that stores all child-elements of that node. If there's no SYSCTL_DECL macro anywhere else, there's no reason why it shouldn't be static.
* Fix arguments list for proc:::signal-discard DTrace probe.pluknet2011-10-281-1/+1
| | | | | Reported by: Anton Yuzhaninov <citrin citrin ru> MFC after: 1 week
* The sigwait(3) function shall not return EINTR, according to thekib2011-10-011-0/+2
| | | | | | | | | | | | | | POSIX/SUSvN. The sigwait(2) syscall does return EINTR, and libc.so.7 contains the wrapper sigwait(3) which hides EINTR from callers. The EINTR return is used by libthr to handle required cancellation point in the sigwait(3). To help the binaries linked against pre-libc.so.7, i.e. RELENG_6 and earlier, to have right ABI for sigwait(3), transform EINTR return from sigwait(2) into ERESTART. Discussed with: davidxu MFC after: 1 week
* In order to maximize the re-usability of kernel code in user space thiskmacy2011-09-161-17/+17
| | | | | | | | | | | | | patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz)
* Add experimental support for process descriptorsjonathan2011-08-181-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | A "process descriptor" file descriptor is used to manage processes without using the PID namespace. This is required for Capsicum's Capability Mode, where the PID namespace is unavailable. New system calls pdfork(2) and pdkill(2) offer the functional equivalents of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote process for debugging purposes. The currently-unimplemented pdwait(2) will, in the future, allow querying rusage/exit status. In the interim, poll(2) may be used to check (and wait for) process termination. When a process is referenced by a process descriptor, it does not issue SIGCHLD to the parent, making it suitable for use in libraries---a common scenario when using library compartmentalisation from within large applications (such as web browsers). Some observers may note a similarity to Mach task ports; process descriptors provide a subset of this behaviour, but in a UNIX style. This feature is enabled by "options PROCDESC", but as with several other Capsicum kernel features, is not enabled by default in GENERIC 9.0. Reviewed by: jhb, kib Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Fix support for RACCT_CORE by merging forgotten file.trasz2011-05-261-2/+4
|
* ktrace: Log the code for all signals (PSIG events).jilles2011-04-171-2/+2
| | | | | | | | | | | The code provides information on how the signal was generated. Formerly, the code was only logged for traps, much like only signal handlers for traps received a meaningful si_code before FreeBSD 7.0. In rare cases, no information is available and 0 is still logged. MFC after: 1 week
* Fix several places to ignore processes that are not yet fully constructed.jhb2011-04-061-2/+4
| | | | MFC after: 1 week
* Small style fix.jhb2011-03-231-1/+1
|
* Allow debugger to specify that children of the traced process should bekib2011-01-251-0/+4
| | | | | | | | automatically traced. Extend the ptrace(PL_LWPINFO) to report that child just forked. Reviewed by: davidxu, jhb MFC after: 2 weeks
* In kern_sigtimedwait(), move initialization code out of process lock,davidxu2010-10-141-103/+86
| | | | | | | | | | | | | instead of using SIGISMEMBER to test every interesting signal, just unmask the signal set and let cursig() return one, get the signal after it returns, call reschedule_signal() after signals are blocked again. In kern_sigprocmask(), don't call reschedule_signal() when it is unnecessary. In reschedule_signal(), replace SIGISEMPTY() + SIGISMEMBER() with sig_ffs(), rename variable 'i' to sig.
* sigqueue_collect_set() is no longer needed because other functionsdavidxu2010-10-131-29/+7
| | | | maintain pending set correctly.
OpenPOWER on IntegriCloud