The branch main has been updated by jfree:
URL:
https://cgit.FreeBSD.org/src/commit/?id=964687879a38034d3f0221d3c73b9add6cadb567
commit 964687879a38034d3f0221d3c73b9add6cadb567
Author: Jake Freeland <jf...@freebsd.org>
AuthorDate: 2024-11-27 22:25:03 +0000
Commit: Jake Freeland <jf...@freebsd.org>
CommitDate: 2024-11-27 22:25:03 +0000
syslogd: Create syslogd libcasper service
Once in capability mode, resource acquisition is not possible. To
mitigate this, introduce a libcasper service that is responsible for
fetching and returning new, requested resources to syslogd.
Some resources must be packed into an nvlist to be properly transferred
between syslogd and the libcasper process. The filed_to_nvlist() and
nvlist_to_filed() functions are included to ease the packing process for
filed structures.
Two additional syslogd.h and syslogd_cap.h header files are included
with shared declarations.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D41463
---
usr.sbin/syslogd/Makefile | 5 ++
usr.sbin/syslogd/syslogd.c | 118 +--------------------------
usr.sbin/syslogd/syslogd.h | 179 +++++++++++++++++++++++++++++++++++++++++
usr.sbin/syslogd/syslogd_cap.c | 49 +++++++++++
usr.sbin/syslogd/syslogd_cap.h | 52 ++++++++++++
5 files changed, 287 insertions(+), 116 deletions(-)
diff --git a/usr.sbin/syslogd/Makefile b/usr.sbin/syslogd/Makefile
index bc4a34367195..e9e7455ed2cc 100644
--- a/usr.sbin/syslogd/Makefile
+++ b/usr.sbin/syslogd/Makefile
@@ -13,6 +13,11 @@ SYSLOGD_DPACAKGE= syslogd
LIBADD= util
+.if ${MK_CASPER} != "no"
+SRCS+= syslogd_cap.c
+CFLAGS+= -DWITH_CASPER
+LIBADD+= cap_net casper nv
+.endif
.if ${MK_INET_SUPPORT} != "no"
CFLAGS+= -DINET
.endif
diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
index 8fcf3f06cf95..5f8c51d85fb3 100644
--- a/usr.sbin/syslogd/syslogd.c
+++ b/usr.sbin/syslogd/syslogd.c
@@ -67,12 +67,6 @@
* To kill syslogd, send a signal 15 (terminate). A signal 1 (hup) will
* cause it to reread its configuration file.
*
- * Defined Constants:
- *
- * MAXLINE -- the maximum line length that can be handled.
- * DEFUPRI -- the default priority for user messages
- * DEFSPRI -- the default priority for kernel messages
- *
* Author: Eric Allman
* extensive changes by Ralph Campbell
* more extensive changes by Eric Allman (again)
@@ -82,8 +76,6 @@
* Priority comparison code by Harlan Stenn.
*/
-#define MAXLINE 8192 /* maximum line length */
-#define MAXSVLINE MAXLINE /* maximum saved line length */
#define DEFUPRI (LOG_USER|LOG_NOTICE)
#define DEFSPRI (LOG_KERN|LOG_CRIT)
#define TIMERINTVL 30 /* interval for checking flush,
mark */
@@ -135,11 +127,10 @@
#include <utmpx.h>
#include "pathnames.h"
+#include "syslogd.h"
+#include "syslogd_cap.h"
#include "ttymsg.h"
-#define SYSLOG_NAMES
-#include <sys/syslog.h>
-
static const char *ConfFile = _PATH_LOGCONF;
static const char *PidFile = _PATH_LOGPID;
static const char include_str[] = "include";
@@ -147,8 +138,6 @@ static const char include_ext[] = ".conf";
#define dprintf if (Debug) printf
-#define MAXUNAMES 20 /* maximum number of user names */
-
#define sstosa(ss) ((struct sockaddr *)(ss))
#ifdef INET
#define sstosin(ss) ((struct sockaddr_in *)(void *)(ss))
@@ -202,117 +191,14 @@ static STAILQ_HEAD(, socklist) shead =
STAILQ_HEAD_INITIALIZER(shead);
#define MARK 0x008 /* this message is a mark */
#define ISKERNEL 0x010 /* kernel generated message */
-/* Timestamps of log entries. */
-struct logtime {
- struct tm tm;
- suseconds_t usec;
-};
-
/* Traditional syslog timestamp format. */
#define RFC3164_DATELEN 15
#define RFC3164_DATEFMT "%b %e %H:%M:%S"
-enum filt_proptype {
- FILT_PROP_NOOP,
- FILT_PROP_MSG,
- FILT_PROP_HOSTNAME,
- FILT_PROP_PROGNAME,
-};
-
-enum filt_cmptype {
- FILT_CMP_CONTAINS,
- FILT_CMP_EQUAL,
- FILT_CMP_STARTS,
- FILT_CMP_REGEX,
-};
-
-/*
- * This structure holds a property-based filter
- */
-struct prop_filter {
- enum filt_proptype prop_type;
- enum filt_cmptype cmp_type;
- uint8_t cmp_flags;
-#define FILT_FLAG_EXCLUDE (1 << 0)
-#define FILT_FLAG_ICASE (1 << 1)
- union {
- char *p_strval;
- regex_t *p_re;
- } pflt_uniptr;
-#define pflt_strval pflt_uniptr.p_strval
-#define pflt_re pflt_uniptr.p_re
- size_t pflt_strlen;
-};
-
-enum f_type {
- F_UNUSED, /* unused entry */
- F_FILE, /* regular file */
- F_TTY, /* terminal */
- F_CONSOLE, /* console terminal */
- F_FORW, /* remote machine */
- F_USERS, /* list of users */
- F_WALL, /* everyone logged on */
- F_PIPE, /* pipe to program */
-};
-
-/*
- * This structure represents the files that will have log
- * copies printed.
- * We require f_file to be valid if f_type is F_FILE, F_CONSOLE, F_TTY
- * or if f_type is F_PIPE and f_pid > 0.
- */
-struct filed {
- enum f_type f_type;
-
- /* Used for filtering. */
- char *f_host; /* host from which to recd. */
- char *f_program; /* program this applies to */
- struct prop_filter *f_prop_filter; /* property-based filter */
- u_char f_pmask[LOG_NFACILITIES+1]; /* priority mask */
- u_char f_pcmp[LOG_NFACILITIES+1]; /* compare priority */
-#define PRI_LT 0x1
-#define PRI_EQ 0x2
-#define PRI_GT 0x4
-
- /* Logging destinations. */
- int f_file; /* file descriptor */
- int f_flags; /* file-specific flags */
-#define FFLAG_SYNC 0x01
-#define FFLAG_NEEDSYNC 0x02
- union {
- char f_uname[MAXUNAMES][MAXLOGNAME]; /* F_WALL, F_USERS */
- char f_fname[MAXPATHLEN]; /* F_FILE, F_CONSOLE, F_TTY */
- struct {
- char f_hname[MAXHOSTNAMELEN];
- struct addrinfo *f_addr;
- } f_forw; /* F_FORW */
- struct {
- char f_pname[MAXPATHLEN];
- int f_procdesc;
- } f_pipe; /* F_PIPE */
- } f_un;
-#define fu_uname f_un.f_uname
-#define fu_fname f_un.f_fname
-#define fu_forw_hname f_un.f_forw.f_hname
-#define fu_forw_addr f_un.f_forw.f_addr
-#define fu_pipe_pname f_un.f_pipe.f_pname
-#define fu_pipe_pd f_un.f_pipe.f_procdesc
-
- /* Book-keeping. */
- char f_prevline[MAXSVLINE]; /* last message logged */
- time_t f_time; /* time this was last written */
- struct logtime f_lasttime; /* time of last occurrence */
- int f_prevpri; /* pri of f_prevline */
- size_t f_prevlen; /* length of f_prevline */
- int f_prevcount; /* repetition cnt of prevline */
- u_int f_repeatcount; /* number of "repeated" msgs */
- STAILQ_ENTRY(filed) next; /* next in linked list */
-};
static STAILQ_HEAD(, filed) fhead =
STAILQ_HEAD_INITIALIZER(fhead); /* Log files that we write to */
static struct filed consfile; /* Console */
-
/*
* Queue of about-to-be dead processes we should watch out for.
*/
diff --git a/usr.sbin/syslogd/syslogd.h b/usr.sbin/syslogd/syslogd.h
new file mode 100644
index 000000000000..ccf4787c087e
--- /dev/null
+++ b/usr.sbin/syslogd/syslogd.h
@@ -0,0 +1,179 @@
+/*-
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Copyright (c) 1983, 1988, 1993, 1994
+ * The Regents of the University of California. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ * may be used to endorse or promote products derived from this software
+ * without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2018 Prodrive Technologies, https://prodrive-technologies.com/
+ * Author: Ed Schouten <e...@freebsd.org>
+ * Copyright (c) 2023 The FreeBSD Foundation
+ *
+ * This software was developed by Jake Freeland <jf...@freebsd.org>
+ * under sponsorship from the FreeBSD Foundation.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef _SYSLOGD_H_
+#define _SYSLOGD_H_
+
+#include <sys/param.h>
+#include <sys/queue.h>
+#include <sys/time.h>
+
+#define SYSLOG_NAMES
+#include <sys/syslog.h>
+
+#include <regex.h>
+
+#define MAXLINE 8192 /* maximum line length */
+#define MAXSVLINE MAXLINE /* maximum saved line length */
+#define MAXUNAMES 20 /* maximum number of user names
*/
+
+/* Timestamps of log entries. */
+struct logtime {
+ struct tm tm;
+ suseconds_t usec;
+};
+
+enum filt_proptype {
+ FILT_PROP_NOOP,
+ FILT_PROP_MSG,
+ FILT_PROP_HOSTNAME,
+ FILT_PROP_PROGNAME,
+};
+
+enum filt_cmptype {
+ FILT_CMP_CONTAINS,
+ FILT_CMP_EQUAL,
+ FILT_CMP_STARTS,
+ FILT_CMP_REGEX,
+};
+
+/*
+ * This structure holds a property-based filter
+ */
+struct prop_filter {
+ enum filt_proptype prop_type;
+ enum filt_cmptype cmp_type;
+ uint8_t cmp_flags;
+#define FILT_FLAG_EXCLUDE (1 << 0)
+#define FILT_FLAG_EXTENDED (1 << 1)
+#define FILT_FLAG_ICASE (1 << 2)
+ char *pflt_strval;
+ size_t pflt_strlen;
+ regex_t *pflt_re;
+};
+
+enum f_type {
+ F_UNUSED, /* unused entry */
+ F_FILE, /* regular file */
+ F_TTY, /* terminal */
+ F_CONSOLE, /* console terminal */
+ F_FORW, /* remote machine */
+ F_USERS, /* list of users */
+ F_WALL, /* everyone logged on */
+ F_PIPE, /* pipe to program */
+};
+
+/*
+ * This structure represents the files that will have log
+ * copies printed.
+ * We require f_file to be valid if f_type is F_FILE, F_CONSOLE, F_TTY
+ * or if f_type is F_PIPE and f_pid > 0.
+ */
+struct filed {
+ enum f_type f_type;
+
+ /* Used for filtering. */
+ char *f_host; /* host from which to recd. */
+ char *f_program; /* program this applies to */
+ struct prop_filter *f_prop_filter; /* property-based filter */
+ u_char f_pmask[LOG_NFACILITIES+1]; /* priority mask */
+ u_char f_pcmp[LOG_NFACILITIES+1]; /* compare priority */
+#define PRI_LT 0x1
+#define PRI_EQ 0x2
+#define PRI_GT 0x4
+
+ /* Logging destinations. */
+ int f_file; /* file descriptor */
+ int f_flags; /* file-specific flags */
+#define FFLAG_SYNC 0x01
+#define FFLAG_NEEDSYNC 0x02
+ union {
+ char f_uname[MAXUNAMES][MAXLOGNAME]; /* F_WALL, F_USERS */
+ char f_fname[MAXPATHLEN]; /* F_FILE, F_CONSOLE, F_TTY */
+ struct {
+ char f_hname[MAXHOSTNAMELEN];
+ struct addrinfo *f_addr;
+ } f_forw; /* F_FORW */
+ struct {
+ char f_pname[MAXPATHLEN];
+ int f_procdesc;
+ } f_pipe; /* F_PIPE */
+ } f_un;
+#define fu_uname f_un.f_uname
+#define fu_fname f_un.f_fname
+#define fu_forw_hname f_un.f_forw.f_hname
+#define fu_forw_addr f_un.f_forw.f_addr
+#define fu_pipe_pname f_un.f_pipe.f_pname
+#define fu_pipe_pd f_un.f_pipe.f_procdesc
+
+ /* Book-keeping. */
+ char f_prevline[MAXSVLINE]; /* last message logged */
+ time_t f_time; /* time this was last written */
+ struct logtime f_lasttime; /* time of last occurrence */
+ int f_prevpri; /* pri of f_prevline */
+ size_t f_prevlen; /* length of f_prevline */
+ int f_prevcount; /* repetition cnt of prevline */
+ u_int f_repeatcount; /* number of "repeated" msgs */
+ STAILQ_ENTRY(filed) next; /* next in linked list */
+};
+
+#endif /* !_SYSLOGD_H_ */
diff --git a/usr.sbin/syslogd/syslogd_cap.c b/usr.sbin/syslogd/syslogd_cap.c
new file mode 100644
index 000000000000..71fc89854c58
--- /dev/null
+++ b/usr.sbin/syslogd/syslogd_cap.c
@@ -0,0 +1,49 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2023 The FreeBSD Foundation
+ *
+ * This software was developed by Jake Freeland <jf...@freebsd.org>
+ * under sponsorship from the FreeBSD Foundation.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <libcasper.h>
+
+#include <casper/cap_net.h>
+
+#include "syslogd_cap.h"
+
+/* This is where libcasper receives commands via nvlist. */
+static int
+casper_command(const char *cmd __unused, const nvlist_t *limits __unused,
+ nvlist_t *nvlin __unused, nvlist_t *nvlout __unused)
+{
+ int error = EINVAL;
+ return (error);
+}
+
+CREATE_SERVICE("syslogd.casper", NULL, casper_command, CASPER_SERVICE_STDIO);
diff --git a/usr.sbin/syslogd/syslogd_cap.h b/usr.sbin/syslogd/syslogd_cap.h
new file mode 100644
index 000000000000..fdfc969b3d0f
--- /dev/null
+++ b/usr.sbin/syslogd/syslogd_cap.h
@@ -0,0 +1,52 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2023 The FreeBSD Foundation
+ *
+ * This software was developed by Jake Freeland <jf...@freebsd.org>
+ * under sponsorship from the FreeBSD Foundation.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef _SYSLOGD_CAP_H_
+#define _SYSLOGD_CAP_H_
+
+#include <sys/nv.h>
+
+#include <libcasper.h>
+
+#include <casper/cap_net.h>
+
+#ifdef WITH_CASPER
+
+#include <sys/capsicum.h>
+#include <sys/dnv.h>
+
+#include <capsicum_helpers.h>
+#include <libcasper_service.h>
+
+#include "syslogd.h"
+
+#endif /* WITH_CASPER */
+
+#endif /* !_SYSLOGD_CAP_H_ */
