Remove residual blank line at start of Makefile

This is a residual of the $FreeBSD$ removal.

MFC After: 3 days (though I'll just run the command on the branches)
Sponsored by: Netflix

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

tests/sys/audit: force PIE off

df093aa9463b linked against libprivateauditd.a, but that is currently
(and incorrectly) built as position-dependent. For now just force PIE
off for this test to fix t

tests/sys/audit: force PIE off

df093aa9463b linked against libprivateauditd.a, but that is currently
(and incorrectly) built as position-dependent. For now just force PIE
off for this test to fix the WITH_PIE build.

Sponsored by: The FreeBSD Foundation

show more ...

tests/sys/audit: Avoid race caused by starting auditd(8) for testing

In the CheriBSD CI we reproducibly see the first test in sys/audit
(administrative:acct_failure) fail due to a missing startup me

tests/sys/audit: Avoid race caused by starting auditd(8) for testing

In the CheriBSD CI we reproducibly see the first test in sys/audit
(administrative:acct_failure) fail due to a missing startup message.
It appears this is caused by a race condition when starting auditd:
`service auditd onestart` returns as soon as the initial auditd() parent
exits (after the daemon(3) call).
We can avoid this problem by setting up the auditd infrastructure
in-process: libauditd contains audit_quick_{start,stop}() functions that
look like they are ideally suited to this task.
This patch also avoids forking lots of shell processes for each of the 418
tests by using `auditon(A_SENDTRIGGER, &trigger, sizeof(trigger))` to check
for a running auditd(8) instead of using `service auditd onestatus`.

With these two changes (and D28388 to fix the XFAIL'd test) I can now
boot and run `cd /usr/tests/sys/audit && kyua test` without any failures
in a single-core QEMU instance. Before there would always be at least one
failed test.

Besides making the tests more reliable in CI, a nice side-effect of this
change is that it also significantly speeds up running them by avoiding
lots of fork()/execve() caused by shell scripts:
Running kyua test on an AArch64 QEMU took 315s before and now takes 68s,
so it's roughly 3.5 times faster. This effect is even larger when running
on a CHERI-RISC-V QEMU since emulating CHERI instructions on an x86 host
is noticeably slower than emulating AArch64.

Test Plan: aarch64+amd64 QEMU no longer fail.

Reviewed By: asomers
Differential Revision: https://reviews.freebsd.org/D28451

show more ...

Do a sweep and remove most WARNS=6 settings

Repeating the default WARNS here makes it slightly more difficult to
experiment with default WARNS changes, e.g. if we did something absolutely
bananas an

Do a sweep and remove most WARNS=6 settings

Repeating the default WARNS here makes it slightly more difficult to
experiment with default WARNS changes, e.g. if we did something absolutely
bananas and introduced a WARNS=7 and wanted to try lifting the default to
that.

Drop most of them; there is one in the blake2 kernel module, but I suspect
it should be dropped -- the default WARNS in the rest of the build doesn't
currently apply to kernel modules, and I haven't put too much thought into
whether it makes sense to make it so.

show more ...

Make audit tests depend on /dev/auditpipe. This should fix
some 416 failing tests on armv7:

https://ci.freebsd.org/job/FreeBSD-head-armv7-test/lastCompletedBuild/testReport/

Reviewed by: asomers
MF

Make audit tests depend on /dev/auditpipe. This should fix
some 416 failing tests on armv7:

https://ci.freebsd.org/job/FreeBSD-head-armv7-test/lastCompletedBuild/testReport/

Reviewed by: asomers
MFC after: 2 weeks
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D25144

show more ...

MFHead@r345880

Fix and simplify code by using ATF_REQUIRE_FEATURE macro

PR: 236857
Reviewed by: asomers, ngie
Approved by: emaste
MFC after: 1 month
Sponsored by: Netflix

audit(4) tests: require /etc/rc.d/auditd

These tests should be skipped if /etc/rc.d/auditd is missing, which could be
the case if world was built with WITHOUT_AUDIT set. Also, one test case
require

audit(4) tests: require /etc/rc.d/auditd

These tests should be skipped if /etc/rc.d/auditd is missing, which could be
the case if world was built with WITHOUT_AUDIT set. Also, one test case
requires /etc/rc.d/accounting.

Submitted by: ngie
MFC after: 2 weeks
Pull Request: https://github.com/freebsd/freebsd/pull/240

show more ...

Merge ^/head r336870 through r337285, and resolve conflicts.

Remove residual blank line at start of Makefile

This is a residual of the $FreeBSD$ removal.

MFC After: 3 days (though I'll just run the command on the branches)
Sponsored by: Netflix

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

tests/sys/audit: force PIE off

df093aa9463b linked against libprivateauditd.a, but that is currently
(and incorrectly) built as position-dependent. For now just force PIE
off for this test to fix t

tests/sys/audit: force PIE off

df093aa9463b linked against libprivateauditd.a, but that is currently
(and incorrectly) built as position-dependent. For now just force PIE
off for this test to fix the WITH_PIE build.

Sponsored by: The FreeBSD Foundation

show more ...

tests/sys/audit: Avoid race caused by starting auditd(8) for testing

In the CheriBSD CI we reproducibly see the first test in sys/audit
(administrative:acct_failure) fail due to a missing startup me

tests/sys/audit: Avoid race caused by starting auditd(8) for testing

In the CheriBSD CI we reproducibly see the first test in sys/audit
(administrative:acct_failure) fail due to a missing startup message.
It appears this is caused by a race condition when starting auditd:
`service auditd onestart` returns as soon as the initial auditd() parent
exits (after the daemon(3) call).
We can avoid this problem by setting up the auditd infrastructure
in-process: libauditd contains audit_quick_{start,stop}() functions that
look like they are ideally suited to this task.
This patch also avoids forking lots of shell processes for each of the 418
tests by using `auditon(A_SENDTRIGGER, &trigger, sizeof(trigger))` to check
for a running auditd(8) instead of using `service auditd onestatus`.

With these two changes (and D28388 to fix the XFAIL'd test) I can now
boot and run `cd /usr/tests/sys/audit && kyua test` without any failures
in a single-core QEMU instance. Before there would always be at least one
failed test.

Besides making the tests more reliable in CI, a nice side-effect of this
change is that it also significantly speeds up running them by avoiding
lots of fork()/execve() caused by shell scripts:
Running kyua test on an AArch64 QEMU took 315s before and now takes 68s,
so it's roughly 3.5 times faster. This effect is even larger when running
on a CHERI-RISC-V QEMU since emulating CHERI instructions on an x86 host
is noticeably slower than emulating AArch64.

Test Plan: aarch64+amd64 QEMU no longer fail.

Reviewed By: asomers
Differential Revision: https://reviews.freebsd.org/D28451

show more ...

Do a sweep and remove most WARNS=6 settings

Repeating the default WARNS here makes it slightly more difficult to
experiment with default WARNS changes, e.g. if we did something absolutely
bananas an

Do a sweep and remove most WARNS=6 settings

Repeating the default WARNS here makes it slightly more difficult to
experiment with default WARNS changes, e.g. if we did something absolutely
bananas and introduced a WARNS=7 and wanted to try lifting the default to
that.

Drop most of them; there is one in the blake2 kernel module, but I suspect
it should be dropped -- the default WARNS in the rest of the build doesn't
currently apply to kernel modules, and I haven't put too much thought into
whether it makes sense to make it so.

show more ...

Make audit tests depend on /dev/auditpipe. This should fix
some 416 failing tests on armv7:

https://ci.freebsd.org/job/FreeBSD-head-armv7-test/lastCompletedBuild/testReport/

Reviewed by: asomers
MF

Make audit tests depend on /dev/auditpipe. This should fix
some 416 failing tests on armv7:

https://ci.freebsd.org/job/FreeBSD-head-armv7-test/lastCompletedBuild/testReport/

Reviewed by: asomers
MFC after: 2 weeks
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D25144

show more ...

MFHead@r345880

Fix and simplify code by using ATF_REQUIRE_FEATURE macro

PR: 236857
Reviewed by: asomers, ngie
Approved by: emaste
MFC after: 1 month
Sponsored by: Netflix

audit(4) tests: require /etc/rc.d/auditd

These tests should be skipped if /etc/rc.d/auditd is missing, which could be
the case if world was built with WITHOUT_AUDIT set. Also, one test case
require

audit(4) tests: require /etc/rc.d/auditd

These tests should be skipped if /etc/rc.d/auditd is missing, which could be
the case if world was built with WITHOUT_AUDIT set. Also, one test case
requires /etc/rc.d/accounting.

Submitted by: ngie
MFC after: 2 weeks
Pull Request: https://github.com/freebsd/freebsd/pull/240

show more ...

Merge ^/head r336870 through r337285, and resolve conflicts.

MFH @ r337607, in preparation for boarding

audit(4): add tests for sysctl(3) and sysarch(2)

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D16116

audit(4): add tests for the process-control audit class

Tested syscalls include rfork(2), chdir(2), fchdir(2), chroot(2),
getresuid(2), getresgid(2), setpriority(2), setgroups(2), setpgrp(2),
setrli

audit(4): add tests for the process-control audit class

Tested syscalls include rfork(2), chdir(2), fchdir(2), chroot(2),
getresuid(2), getresgid(2), setpriority(2), setgroups(2), setpgrp(2),
setrlimit(2), setlogin(2), mlock(2), munlock(2), minherit(2), rtprio(2),
profil(2), ktrace(2), ptrace(2), fork(2), umask(2), setuid(2), setgid(2),
seteuid(2), and setegid(2). The last six are only tested in the success
case, either because they're infalliable or a failure is difficult to cause
on-demand.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15966

show more ...

audit(4): add tests for ioctl(2)

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15872

audit(4): Add tests for a few syscalls in the ad class

The ad audit class is for administrative commands. This commit adds test
for settimeofday, adjtime, and getfh.

Submitted by: aniketp
MFC afte

audit(4): Add tests for a few syscalls in the ad class

The ad audit class is for administrative commands. This commit adds test
for settimeofday, adjtime, and getfh.

Submitted by: aniketp
MFC after: 2 weeks
Sponsored by: Google, Inc. (GSoC 2018)
Differential Revision: https://reviews.freebsd.org/D15861

show more ...