HardenedBSD/src 7bcf5fblib/libsys pdfork.2, share/man/man4 ix.4

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+159-71sys/kern/sys_process.c
+90-66sys/compat/freebsd32/freebsd32_misc.c
+0-147sys/arm/ti/clk/clock_common.c
+81-3lib/libsys/pdfork.2
+39-28sys/netpfil/pf/pf.c
+27-14share/man/man4/ix.4
+396-32944 files not shown
+713-42750 files

HardenedBSD/src f210243lib/libutil mntopts.c, sbin/mount_nullfs mount_nullfs.c mount_nullfs.8

Merge remote-tracking branch 'rad/hardened/15-stable/main' into hardened/15-stable/pledge
DeltaFile
+3-3sys/kern/vfs_mount.c
+3-3sys/kern/vfs_cache.c
+3-3sbin/mount_nullfs/mount_nullfs.c
+4-2sbin/mount_nullfs/mount_nullfs.8
+1-1sys/fs/nullfs/null_vfsops.c
+1-1lib/libutil/mntopts.c
+15-136 files

HardenedBSD/src 763875elib/libsys pdfork.2, share/man/man4 ix.4

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+159-71sys/kern/sys_process.c
+90-66sys/compat/freebsd32/freebsd32_misc.c
+0-147sys/arm/ti/clk/clock_common.c
+81-3lib/libsys/pdfork.2
+39-28sys/netpfil/pf/pf.c
+27-14share/man/man4/ix.4
+396-32944 files not shown
+713-42750 files

HardenedBSD/src b2c1e52lib/libutil mntopts.c, sbin/mount_nullfs mount_nullfs.c mount_nullfs.8

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+3-3sys/kern/vfs_mount.c
+3-3sys/kern/vfs_cache.c
+3-3sbin/mount_nullfs/mount_nullfs.c
+4-2sbin/mount_nullfs/mount_nullfs.8
+1-1sys/fs/nullfs/null_vfsops.c
+1-1lib/libutil/mntopts.c
+15-136 files

HardenedBSD/src a9fd65dsys/arm/ti ti_pruss.c, sys/arm/ti/am335x am335x_dmtpps.c am335x_dmtimer.c

TI AM335x: update clock names

Due to upstream has changed to use clock-output-names we need
to update the names in our code aswell.

Approved by: imp(earlier revison), manu(mentor)
Tested by: Rick Richard
Differential revision: https://reviews.freebsd.org/D46713
DeltaFile
+2-3sys/arm/ti/am335x/am335x_lcd.c
+2-2sys/arm/ti/ti_pruss.c
+2-2sys/arm/ti/am335x/am335x_dmtpps.c
+2-2sys/arm/ti/am335x/am335x_dmtimer.c
+8-94 files

HardenedBSD/src f542fe4share/man/man4 ix.4

ix.4: Canonicalize SYNOPSIS

While here, fix markup on one of the items.

MFC after:      3 days
DeltaFile
+27-14share/man/man4/ix.4
+27-141 files

HardenedBSD/src 4802753share/man/man4 zyd.4

zyd.4: Canonicalize SYNOPSIS and HARDWARE

MFC after:      3 days
DeltaFile
+12-19share/man/man4/zyd.4
+12-191 files

HardenedBSD/src 541aa93sys/arm/ti files.ti, sys/arm/ti/clk clock_common.h clock_common.c

TI AM335x: Remove clock_common.*

These helper function will not be needed anymore
because the way that clocks are parsed from the DTS is reworked.

Approved by: imp, manu(mentor)
Tested by: Rick Richard
Differential revision: https://reviews.freebsd.org/D46712
DeltaFile
+0-147sys/arm/ti/clk/clock_common.c
+0-39sys/arm/ti/clk/clock_common.h
+0-1sys/arm/ti/files.ti
+0-1873 files

HardenedBSD/src da8b3e7bin/stty stty.1

stty(1): list DISCARD control character
DeltaFile
+1-0bin/stty/stty.1
+1-01 files

HardenedBSD/src 1853976lib/libutil mntopts.c, sbin/mount_nullfs mount_nullfs.c mount_nullfs.8

nullfs: Allow VSOCK to be mounted on top of another VSOCK

In the world of containers, mounting a unix(4) socket is a common
practice to allow communication between processes within containers.
For example, both Podman and Docker can expose a unix(4) socket,
and that same unix(4) socket can be mounted as a file accessible
to a process inside a container, allowing that application to control
Podman or Docker. Another example is PHP-FPM with NGINX, where,
instead of using TCP/IP for communication between containers, a
unix(4) socket is sufficient.

However, nullfs(4) and all related components do not allow mounting
a VSOCK on top of another. The current workaround involves creating
the socket in a directory and mounting that directory. This is an
option, though it does not provide a good user experience compared
to directly mounting a VSOCK on top of another, since the application
that creates the socket may create other sockets in that directory,
and the user may not wish to share them, or, worse yet, applications
that create unix(4) sockets may not provide any authentication at

    [9 lines not shown]
DeltaFile
+3-3sys/kern/vfs_mount.c
+3-3sys/kern/vfs_cache.c
+3-3sbin/mount_nullfs/mount_nullfs.c
+4-2sbin/mount_nullfs/mount_nullfs.8
+1-1sys/fs/nullfs/null_vfsops.c
+1-1lib/libutil/mntopts.c
+15-136 files

HardenedBSD/src ad9b4ccstand/efi/loader/arch/i386 setup.c amd64_tramp.S, sys/dev/gpio acpi_gpiobus.c

update email address in my copyright notices
DeltaFile
+1-1sys/dev/gpio/acpi_gpiobus.c
+1-1stand/efi/loader/arch/i386/setup.c
+1-1stand/efi/loader/arch/i386/amd64_tramp.S
+3-33 files

HardenedBSD/src bf05236sys/netpfil/pf pf.h pf_syncookies.c

pf: Send syncookies from the receiving thread

pf sends outbound packets by offloading them to a single per-vnet SWI handler
through the `V_pf_sendqueue` mbuf queue. A large DDoS attack may overwhelm
that per-vnet queue with syncookie packets and cause contention in the SWI
handler that negatively affects other pf operations.

Fix this by sending the initial syncookie challenge from the context
of the receiving thread. This avoids the syncookie-induced contention on
the `pf_intr` mbuf queue.

Sponsored by:   Klara, Inc.
Sponsored by:   Entersekt
MFC after:      3 weeks
Reviewed by:    kp
Differential Revision:  https://reviews.freebsd.org/D59068
DeltaFile
+39-28sys/netpfil/pf/pf.c
+29-3sys/netpfil/pf/pf_syncookies.c
+8-1sys/netpfil/pf/pf.h
+76-323 files

HardenedBSD/src b95ee60sys/kern uipc_usrreq.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+70-38sys/kern/uipc_usrreq.c
+70-381 files

HardenedBSD/src 2d596a5sys/kern uipc_usrreq.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+70-38sys/kern/uipc_usrreq.c
+70-381 files

HardenedBSD/src ddf62c8tests/sys/kern procdesc.c

sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode

Adjust test to check for ECAPMODE using grandchild instead of child.
Childrens can be opened even in cap mode.  Add test for the later.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+34-4tests/sys/kern/procdesc.c
+34-41 files

HardenedBSD/src 73c92a9sys/kern syscalls.master sys_procdesc.c

pdopenpid(2): allow in capability mode with restrictions

The pdopenpid() syscall is allowed to open processes which are either
direct children of the caller, or are debuggees already attached to the
calling process. This is reasonable because we could have controlled the
child on fork anyway.

The procdesc-less debuggee can legitimately appear due to ptrace
FOLLOW-FORK mode.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+6-0sys/kern/sys_procdesc.c
+1-1sys/kern/syscalls.master
+7-12 files

HardenedBSD/src 7006cb7sys/compat/freebsd32 freebsd32_misc.c, sys/kern syscalls.master sys_process.c

pdptrace(2): allow debugging in capability mode

The pdopenpid(2) syscall is allowed in capability mode. Add the chicken
switch security.bsd.ptrace_in_cap_mode, which disables it without
reboot, if needed.

The descriptor passed to pdptrace(2) must have the CAP_PTRACE
capability enabled. This capability is not enabled by default by
pdfork()/pdopenpid(), and the calls do not return a procdesc suitable
for debugging. The opening code must prepare for debugging in advance by
passing the PD_PTRACE_CAP flag to pdfork()/pdopenpid().

For ptrace(2), allow PT_CLEARSTEP and PT_GET_CHILDREN for the current
thread and process in cap mode as well.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+22-4sys/kern/sys_process.c
+2-2sys/kern/syscalls.master
+0-3sys/compat/freebsd32/freebsd32_misc.c
+24-93 files

HardenedBSD/src 1ac08a4lib/libsys ptrace.2 pdfork.2

pdfork.2: document cap mode, namely pdopenpid(2) and pdptrace(2) errors

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+33-0lib/libsys/pdfork.2
+10-0lib/libsys/ptrace.2
+43-02 files

HardenedBSD/src 1d20ebbsys/compat/freebsd32 freebsd32_sysent.c, sys/kern init_sysent.c

Regen
DeltaFile
+3-3sys/kern/init_sysent.c
+3-3sys/compat/freebsd32/freebsd32_sysent.c
+6-62 files

HardenedBSD/src 68d4b31sys/kern sys_process.c kern_prot.c, sys/sys ptrace.h proc.h

kern: add p_canopen()

The function defines the policy for allowing to open a pid.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+26-2sys/kern/kern_prot.c
+5-0sys/kern/sys_process.c
+1-0sys/sys/ptrace.h
+1-0sys/sys/proc.h
+33-24 files

HardenedBSD/src 3dfd63blib/libsys ptrace.2

ptrace.2: document PT_GET_ABI_NAME

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59113
DeltaFile
+11-0lib/libsys/ptrace.2
+11-01 files

HardenedBSD/src 6b9ef5dsys/compat/freebsd32 freebsd32_misc.c, sys/kern sys_process.c

ptrace(2): add PT_GET_ABI_NAME request

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59113
DeltaFile
+19-1sys/kern/sys_process.c
+12-0sys/compat/freebsd32/freebsd32_misc.c
+1-0sys/sys/ptrace.h
+32-13 files

HardenedBSD/src 5f5910btests/sys/kern pdwait.c

tests/sys/kern/pdwait: adjust test for the addition of CAP_PTRACE

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+1-1tests/sys/kern/pdwait.c
+1-11 files

HardenedBSD/src 4563360lib/libsys ptrace.2 pdfork.2, share/man/man4 rights.4

pdfork.2, rights.4: document pdptrace(2), CAP_PTRACE, and pdfork(PD_PTRACE_CAP)

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+48-3lib/libsys/pdfork.2
+3-0share/man/man4/rights.4
+1-0lib/libsys/ptrace.2
+52-33 files

HardenedBSD/src 16ff23dsys/compat/freebsd32 freebsd32_proto.h freebsd32_systrace_args.c, sys/kern systrace_args.c

Regen
DeltaFile
+38-0sys/kern/systrace_args.c
+38-0sys/compat/freebsd32/freebsd32_systrace_args.c
+9-0sys/sys/sysproto.h
+9-0sys/compat/freebsd32/freebsd32_proto.h
+2-1sys/sys/syscall.mk
+2-1sys/sys/syscall.h
+98-27 files not shown
+108-313 files

HardenedBSD/src f8c0616sys/compat/freebsd32 freebsd32_misc.c, sys/kern syscalls.master sys_process.c

Add pdptrace(2)

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+61-22sys/kern/sys_process.c
+19-5sys/compat/freebsd32/freebsd32_misc.c
+9-0sys/kern/syscalls.master
+2-2sys/sys/ptrace.h
+91-294 files

HardenedBSD/src 6d17a04lib/libsys Symbol.sys.map, sys/sys procdesc.h

lib/libsys: export pdptrace(2)

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+1-0sys/sys/procdesc.h
+1-0lib/libsys/Symbol.sys.map
+2-02 files

HardenedBSD/src 9cea869sys/compat/freebsd32 freebsd32_misc.c, sys/kern sys_process.c

ptrace: split sys_ptrace()/freebsd32_ptrace()

The code to handle copyin and copyout of the structured parameters is
moved into the helpers.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+65-64sys/compat/freebsd32/freebsd32_misc.c
+61-53sys/kern/sys_process.c
+2-0sys/sys/ptrace.h
+128-1173 files

HardenedBSD/src b2f300esys/bsm audit_kevents.h

sys/bsm/audit_kevents.h: add AUE_PDPTRACE

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+1-0sys/bsm/audit_kevents.h
+1-01 files

HardenedBSD/src 5f82dd8sys/kern subr_capability.c, sys/sys caprights.h capsicum.h

capsicum: add CAP_PTRACE

The capability will allow the ptrace(2) on the procdesc.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+5-3sys/sys/capsicum.h
+1-0sys/sys/caprights.h
+1-0sys/kern/subr_capability.c
+7-33 files