Remove PROC_CHECK_PRIV macro from sys_process.c
Just put the priv_check calls in the code.
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D56864
emulators/libmt32emu: Adjust pkgconfig dependency
Optional for libsoxr (libsamplerate relies on cmake) but it's a better
approach than having cmake "manually" looking for headers
Approved by: blanket
devd: Use PF_LOCAL instead of PF_INET
Avoid dependency on INET (IPv4) by using PF_LOCAL,
allowing media check to work on systems without INET support.
PR: 295045
Reviewed by: kevans
MFC after: 1 week
jail: open the fstab files with fopen("re")
This protects against accidentally leaking them past fork()+exec()
in future refactorings.
PR: 295052
Reviewed by: kevans
jail: avoid leaking jail config fds to exec.* hooks
The jail(8) command must not leave parsed configuration files open
since the file descriptors will be leaked to child processes
including the untrusted exec.start or exec.stop hooks.
While fopen() doesn't provide direct access to O_CLOEXEC, it does
provide access to FD_CLOEXEC via "e" in the mode string which
provides the desired defense in depth against leaking file descriptors
into exec.* hooks since those always execve() into a shell.
Jail configuration is potentially sensitive and some hooks execute from
within the jail context, leaving some opening for the jail to exfiltrate
information about the host environment.
(Commit message wordsmithed by kevans)
PR: 295052
Reviewed by: kevans
MFC after: 3 days
mail/archiveopteryx: Update to latest git
archiveopteryx has not received an official release in many years and
many fixes have been accumulating. I have traditionally published the
git version under the mail/archiveopteryhx-devel port, but many
improvements have happened that aox users should be getting by default.
I'm working with upstream to get a new release finally made.
While here, correct the LICENSE which is actually PostgreSQL, not MIT.
Unskip test sys.netinet6.frag6.frag6_07.frag6_07
This is now consistently passing with 100+ consecutive runs.
Signed-off-by: Siva Mahadevan <me at svmhdvn.name>
PR: 244170
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 681e9d3e391f30a512c523514f69a63c9782a901)
tests/if_lagg_test: unskip 'witness' testcase
This testcase passes consistently (in 100+ runs) now.
Signed-off-by: Siva Mahadevan <me at svmhdvn.name>
PR: 244163, 251726
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 7a83fedc116d827cc9c6d8e049b785f1d7b68dcd)
nuageninit: modify the test to show the issue fixed inc316ec259011
Ensure the script used is invalid when parsed by libyaml which
highlight the issue revealed in PR295062
while at here validate the mode of the file is properly changed
PR: 295062
MFC After: 1 day
