NAS-142160 / 27.0.0-BETA.1 / Restrict mutation of pass-through config fields to FULL_ADMIN (#19553)
Several public API fields pass caller-supplied text straight through to
a root command line or to a privileged daemon's configuration file,
handing the caller a capability the role guarding the endpoint was never
meant to grant. `rsynctask.extra` becomes rsync flags, where `-e` names
the program rsync spawns; `ssh.options` is interpolated verbatim into
`sshd_config`; `ups.shutdowncmd` is what upsmon runs as root. Two
shipped roles reach one of these with no custom privilege configured:
`REPLICATION_ADMIN` reaches `rsynctask.extra`, and `SHARING_ADMIN`
reaches `ftp.options`.
A new `FullAdmin[...]` marker on the API model restricts mutation of
such a field to callers holding `FULL_ADMIN`. Enforcement lives in
`CRUDService.create`, `CRUDService.update` and `ConfigService.update`,
which already receive `app`, so marking the field is all a plugin has to
do. `cloudsync.list_directory` and `cloudsync.sync_onetime` do not route
through those wrappers and call the helper themselves; a unit test fails
the build if a marked field is ever left with no enforcement path.
[132 lines not shown]
[ELF] Version script: simplify wildcard matching. NFC (#223202)
Replace a loop over non-"*" wildcard patterns and another loop over "*"
with a single loop that calls the inlined
`SymbolTable::assignWildcardVersion`.
[RISCV] Consistently use RISCVSubtarget::is64Bit() instead of isRV32/isRV64. (#223038)
99% of code uses RISCVSubtarget::is64Bit().
Maybe we should consider removing is64Bit(), and using isRV64() instead
but right now I think we should be consistent.
devel/rust-cxxbridge: New port
cxxbridge generates the C++ side of the cxx bridge and is required
at build time by projects that use corrosion's
corrosion_add_cxxbridge() without network access.
stress2: add two new unionfs test scenarios
These exercise lookup traversal from tmpfs into unionfs, which is
useful because, unlike UFS, tmpfs does not allow recursion on its vnode
locks by default.
unionfs22.sh exercises these lookups with a normal unionfs mount, while
unionfs23.sh uses '-o below' for the unionfs mount and reproduces the
panic described in PR 298201.
Reviewed by: kib, markj, pho
Tested by: pho
Differential Revision: https://reviews.freebsd.org/D59494
vfs_lookup_cross_mount(): fix missing LK_CANRECURSE
This was a rather dumb miss on my part in commit 42442d7a6e.
LK_CANRECURSE is clearly needed in any case in which the covered vnode
is held exclusive across the call to VFS_ROOT(), regardless of whether
it was initially held exclusive or upgraded. The commit message for
that change also noted that unionfs lookup only worked without
LK_CANRECURSE due to a coincidence of the then-current unionfs
implementation. As it happens, said coincidence was recently removed
in commit b952606b4f ("unionfs_lock(): eliminate LK_CANRECURSE special-
case").
PR: 298201
Reported by: olivier
Fixes: 42442d7a6e "Generalize the VV_CROSSLOCK logic in
vfs_lookup"
Reviewed by: kib, markj, pho
Tested by: pho
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59494
iwx: fix kernel panic on module unload with assertions enabled
When interface is up and running 'kldunload if_iwx' stops the device and executes RUN -> INIT state transition.
Since the device is already stopped iwx_run_stop fails to stop the device again and returns non-zero exit code from iv_newstate callback which triggers 'INIT state change failed' assertion.
I reused IWX_FLAG_SHUTDOWN flag to:
a) set it in iwx_detach
b) check it in iwx_newstate_sub - when it is set all custom state transition logic is skipped
Accidentally found while experimenting with iwlwifi / iwx drivers
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59624
[ELF,test] Cover wildcard precedence in version scripts and dynamic lists (#223195)
version-script-wildcard-precedence.s, renamed from
version-script-reassign-glob.s, covers more cases.
dynamic-list-glob.s absorbs dynamic-list-cpp.s and adds an extern "C++"
wildcard, which had no --dynamic-list coverage.
