upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-02-28 12:20:54 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
opnsense-src/lib/libcasper/services/Makefile

18 lines
239 B
Makefile
Raw Normal View History

Convert casperd(8) daemon to the libcasper. After calling the cap_init(3) function Casper will fork from it's original process, using pdfork(2). Forking from a process has a lot of advantages: 1. We have the same cwd as the original process. 2. The same uid, gid and groups. 3. The same MAC labels. 4. The same descriptor table. 5. The same routing table. 6. The same umask. 7. The same cpuset(1). From now services are also in form of libraries. We also removed libcapsicum at all and converts existing program using Casper to new architecture. Discussed with: pjd, jonathan, ed, drysdale@google.com, emaste Partially reviewed by: drysdale@google.com, bdrewery Approved by: pjd (mentor) Differential Revision: https://reviews.freebsd.org/D4277
2016-02-25 13:23:40 -05:00
# $FreeBSD$
Introduce caspermocks. The idea behinds mocks is that we don't need to ifdef a lot of code in tools itself but those defines are hidden in the casper library. Right now the mocks are implemented as define/inlines functions. There was a very long discussion how this should be implemented. This approach has some advantages like we don't need to link to any additional libraries. Unfortunately there are also some disadvantages for example it is easy to get library out of sync between two versions of functions or that we need extra define to compile program with casper support. This isn't an ideal solution but it's good enough for now and should simplify capsicumizing programs. This also doesn't close us any other ways to do those mocks and this should evolve in time. Discussed with: pjd, emaste, ed, rwatson, bapt, cem, bdrewery Differential Revision: https://reviews.freebsd.org/D8753
2017-10-28 15:23:57 -04:00
.include <src.opts.mk>
Convert casperd(8) daemon to the libcasper. After calling the cap_init(3) function Casper will fork from it's original process, using pdfork(2). Forking from a process has a lot of advantages: 1. We have the same cwd as the original process. 2. The same uid, gid and groups. 3. The same MAC labels. 4. The same descriptor table. 5. The same routing table. 6. The same umask. 7. The same cpuset(1). From now services are also in form of libraries. We also removed libcapsicum at all and converts existing program using Casper to new architecture. Discussed with: pjd, jonathan, ed, drysdale@google.com, emaste Partially reviewed by: drysdale@google.com, bdrewery Approved by: pjd (mentor) Differential Revision: https://reviews.freebsd.org/D4277
2016-02-25 13:23:40 -05:00
SUBDIR= cap_dns
libcasper: introduce cap_fileargs service cap_fileargs is a Casper service which helps to sandbox applications that need access to the filesystem namespace. The main purpose of the service is to make easy to capsicumize applications that works on multiple files passed in argv. We have a couple example of using it but we still treat this service as an experimental one. Reviewed by: emsate (previous version), jonathan (partially) Discussed with: many Differential Revision: https://reviews.freebsd.org/D14407
2018-11-12 12:40:47 -05:00
SUBDIR+= cap_fileargs
Convert casperd(8) daemon to the libcasper. After calling the cap_init(3) function Casper will fork from it's original process, using pdfork(2). Forking from a process has a lot of advantages: 1. We have the same cwd as the original process. 2. The same uid, gid and groups. 3. The same MAC labels. 4. The same descriptor table. 5. The same routing table. 6. The same umask. 7. The same cpuset(1). From now services are also in form of libraries. We also removed libcapsicum at all and converts existing program using Casper to new architecture. Discussed with: pjd, jonathan, ed, drysdale@google.com, emaste Partially reviewed by: drysdale@google.com, bdrewery Approved by: pjd (mentor) Differential Revision: https://reviews.freebsd.org/D4277
2016-02-25 13:23:40 -05:00
SUBDIR+= cap_grp
libcasper: Introduce cap_net a network service for Casper. Reviewed by: emaste, markj (previous version), bcr (man page) Differential Revision: https://reviews.freebsd.org/D24688
2020-08-16 14:12:21 -04:00
SUBDIR+= cap_net
Convert casperd(8) daemon to the libcasper. After calling the cap_init(3) function Casper will fork from it's original process, using pdfork(2). Forking from a process has a lot of advantages: 1. We have the same cwd as the original process. 2. The same uid, gid and groups. 3. The same MAC labels. 4. The same descriptor table. 5. The same routing table. 6. The same umask. 7. The same cpuset(1). From now services are also in form of libraries. We also removed libcapsicum at all and converts existing program using Casper to new architecture. Discussed with: pjd, jonathan, ed, drysdale@google.com, emaste Partially reviewed by: drysdale@google.com, bdrewery Approved by: pjd (mentor) Differential Revision: https://reviews.freebsd.org/D4277
2016-02-25 13:23:40 -05:00
SUBDIR+= cap_pwd
SUBDIR+= cap_sysctl
Introduce syslog service for Casper. syslog in libc secretly reconnects to the daemon. Another issue is that we don't have any information from openlog(3) if we succeeded to open log or not so we don't know if we are ready to enter cabability mode. Because all of that we decided we need a syslog service for Caspser. Reviewed by: bapt@ Differential Revision: https://reviews.freebsd.org/D12824
2017-11-12 03:34:25 -05:00
SUBDIR+= cap_syslog
Convert casperd(8) daemon to the libcasper. After calling the cap_init(3) function Casper will fork from it's original process, using pdfork(2). Forking from a process has a lot of advantages: 1. We have the same cwd as the original process. 2. The same uid, gid and groups. 3. The same MAC labels. 4. The same descriptor table. 5. The same routing table. 6. The same umask. 7. The same cpuset(1). From now services are also in form of libraries. We also removed libcapsicum at all and converts existing program using Casper to new architecture. Discussed with: pjd, jonathan, ed, drysdale@google.com, emaste Partially reviewed by: drysdale@google.com, bdrewery Approved by: pjd (mentor) Differential Revision: https://reviews.freebsd.org/D4277
2016-02-25 13:23:40 -05:00
Integrate the tests moved in r305626 in to the FreeBSD test suite The reachover Kyuafiles were never added, and thus the tests were installed as standalone tests, and not integrated into the full suite. MFC after: 1 week MFC with: r305626, 305629, r307863, r322447, r322448, r322449
2017-08-12 21:04:44 -04:00
SUBDIR.${MK_TESTS}+= tests
These can build in parallel. Sponsored by: EMC / Isilon Storage Division
2016-02-26 17:14:04 -05:00
SUBDIR_PARALLEL=
Convert casperd(8) daemon to the libcasper. After calling the cap_init(3) function Casper will fork from it's original process, using pdfork(2). Forking from a process has a lot of advantages: 1. We have the same cwd as the original process. 2. The same uid, gid and groups. 3. The same MAC labels. 4. The same descriptor table. 5. The same routing table. 6. The same umask. 7. The same cpuset(1). From now services are also in form of libraries. We also removed libcapsicum at all and converts existing program using Casper to new architecture. Discussed with: pjd, jonathan, ed, drysdale@google.com, emaste Partially reviewed by: drysdale@google.com, bdrewery Approved by: pjd (mentor) Differential Revision: https://reviews.freebsd.org/D4277
2016-02-25 13:23:40 -05:00
.include <bsd.subdir.mk>
Reference in a new issue Copy permalink