rc.subr tests: service jail behaviour of run_rc_command
Twenty cases over where each rc option and each method executes for a
jailed service, the jail's lifetime, and the svcj option handling. Each
case drives the service inside a chroot built in its ATF work directory.
MFC after: 1 week
MFC to: stable/15
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit b5dcd8f9d6ae702adbc1627839b5235a28839370)
rc.subr: svcj - add a setaudit option
setaudit(8) is prefixed to the command inside the jail when
${name}_audit_user is set, and needs allow.setaudit.
This is not added automatically when ${name}_audit_user is set, this
needs an administrative setting of the options on purpose.
MFC after: 1 week
MFC to: stable/15
(cherry picked from commit 9125bc0727dbbf82b1c6a5f7c380f7b8c27b74dd)
rc.conf.5: note that a negative nice value does not reach a service jail
Raising a process' priority is not permitted inside a jail, and nice(1)
warns and executes the command anyway, so the service comes up at its login
class priority.
Not changing the date, as a commit a moment before this, one changed it
already.
MFC after: 1 week
MFC to: stable/15
(cherry picked from commit be834d62e990b58eb2e67ce9b48b635b645dcea1)
rc.subr: svcj - run a service's own restart and status methods in its jail
A script that defines non-default restart_cmd or status_cmd should
execute them in the service jail. Where there is no jail to enter,
restart starts the service instead of failing.
Fixes: 2efbd480f1d3 rc: add service jails framework
MFC after: 1 week
MFC to: stable/15
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 327dae5081059eb97af0cf319a444b3937ff4db2)
rc.subr: svcj - remove the service jail when the service is not running
A service whose tracked process had died while another process of its own
kept the jail alive, therefore left svcj-${name} behind, and the next start
would fail.
Fixes: 2efbd480f1d3 rc: add service jails framework
MFC after: 1 week
MFC to: stable/15
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit a70ca1ebd8add7ea99b5674de715ae5fbf389dce)
rc.subr: svcj - let svcj_all_enable enable service jails
Fix the logic for svcj_all_enable.
Fixes: 2efbd480f1d3 rc: add service jails framework
MFC after: 1 week
MFC to: stable/15
(cherry picked from commit 21e53eeaffcac0be3427b7edb3b8739344a65174)
rc.subr: svcj - send the stop signal from inside the service jail
A service running under ${name}_user was signalled from the host as that
user, which the parent of a jail may no longer do: since 8a5ceebece03 an
unprivileged process would need allow.unprivileged_parent_tampering.
Stop and reload therefore failed and left both the service and its jail
running.
MFC after: 1 week
MFC to: stable/15
(cherry picked from commit 6155e17019f6ae08c74913b7ffb9312434f33a9f)
[IR] Unique attribute sets and lists in a UniquingSet. NFC (#221525)
Switch to UniquingSet to remove FoldingSetNodeID serialization overhead
on every AttributeSet::get and AttributeList::get.
Attribute and AttributeSet are single-pointer wrappers whose operator==
is pointer equality. Specializing `is_hashable_data` selects the fast
`hash_combine_range_impl` overload that calls `combine_bytes` directly,
skipping copying element by element.
`hash_combine_range` deduces its element type as `const T`, so
`is_hashable_data<const T>` now follows `is_hashable_data<T>` and a type
need only specialize the unqualified form.
Aided by Opus 5
net/freeipa-server: Fix client enrollment paths
ipa-join used the upstream default /etc/ipa/ca.crt, so it could not
build a
TLS context and enrollment stopped at "Unable to determine root DN". The
client port already patches this constant; the server port ships the
same
ipaclient tree and needs it too.
configure_krb5_snippet() copied its snippet into a krb5.conf.d that
nothing
creates, which aborted the install with FileNotFoundError. It now
creates
the directory, which is where FreeIPA points krb5.conf's includedir
anyway.
Reported by: usenix17
https://github.com/joneum/FreeBSD-freeipa-server/issues/3
Sponsored by: Netzkommune GmbH
VE: Fix ill-typed setjmp result in emitEHSjLjSetJmp
Partially fixes machine verifier failures in existing tests;
they still fail due to other issues.
emitEHSjLjSetJmp materialized the 0/1 return values with LEAzii, which
defines an i64 register, into vregs with the i32 result register class.
This ill-typed MIR is rejected by -verify-machineinstrs.
Materialize the values in i64 and copy the low 32 bits (sub_i32) into the
i32 result. NFC on the emitted code.
Co-authored-by: Claude (Claude-Opus-4.8)
MC: Move DisableIntegratedAS from TargetOptions to MCTargetOptions
The integrated assembler is only meaningful in MC, so this field belongs
in MCTargetOptions alongside the other assembler options rather than in
the codegen-level TargetOptions.
Co-authored-by: Claude (Claude-Opus-4.8)
d2: update to 0.8.2
Pkgsrc changes:
* Move non-pattern Go flags to GOFLAGS.
* Update GitHub organization and version specifier.
Upstream changes:
Features 🚀
* exports: gif exports work with animate: true keyword
Improvements 🧹
* releases: strip native binaries, build and smoke-test all six archives in
CI, produce reproducible archives with checksums, signed provenance, and
SBOM attestations, and verify standalone downloads when GitHub provides a
digest
[69 lines not shown]
kubectl: update to 1.37.0
Pkgsrc changes:
* Move non-pattern Go flags to GOFLAGS.
Upstream changes:
Dependency
* Updated google.golang.org/grpc to v1.82.1, which adds a server-side limit
on HTTP/2 control frame flooding. It also removes the
GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment variable, so
strict path checking is always on. [SIG API Machinery, Architecture,
Auth, CLI, Cloud Provider, Network, Node and Scheduling]
* Updated the etcd client library to v3.6.10. [SIG API Machinery,
Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Etcd,
Instrumentation, Network, Node, Scheduling and Storage]
[110 lines not shown]
interfaces: loopback experiement
To make interfaces_configure() side effect free
we need to gather all information in the new
interfaces_dependencies() so we can debug and
simplify bootup.
We don't expose the device to the pluggable
device code, but in principle make it pluggable
as interfaces_dependencies() is a good point to
anchor it now.
[IndVarSimplify] Batch forgetValue calls in sinkUnusedInvariants (#219025)
It looks like every `forgetValue` clears the cached SCEV for an
instruction and everything downstream of it, by walking its def-use
children in `visitAndClearUsers` / `PushDefUseChildren` with a fresh
`Visited` each call. Since `sinkUnusedInvariants` calls `forgetValue`
once per sunk instruction, the overlapping users get re-walked over and
over, so it ends up $O(n^2)$.
```cpp
void ScalarEvolution::forgetValue(Value *V) {
SmallPtrSet<Instruction *, 8> Visited;
visitAndClearUsers(Worklist, Visited, ToForget);
...
}
// visitAndClearUsers
while (!Worklist.empty()) {
Instruction *I = Worklist.pop_back_val();
...
[23 lines not shown]
CodeGen: Remove TargetOptions::NoTrappingFPMath (#221429)
This was replaced by the no-trapping-math attribute.
The one ARMAsmPrinter use already accounts for it.
no-trapping-math should probably replaced by !strictfp, but that's
another problem.
