From nobody Mon Jun 29 20:35:54 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpyj66C0Nz6jq7c for ; Mon, 29 Jun 2026 20:35:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpyj63SW6z3Pmd for ; Mon, 29 Jun 2026 20:35:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782765354; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hXYx61l6Zd6XX9xj75WmFWAAtPfLN8KD3clbmJnYmFU=; b=RhiuC2QOblmaZqQxCrmLLS5cF6ZEM20v8nwW/gOmrr3GmhQXLMBULd5TIIrVVP+zkgtzJG Fa7kLRQ/r3fsH2cC4e5pDbc2e4DnkKKm5WpqXyHTIYdVndTGgC2MLaWWwrVJC+akhTqxIl Q00s/5LgB00GG+xKwblNn9QWiBjcfjoKq3bw3FdfArxrPHU1ujnoaXLWxpZN188qMi9kZy kbAqmnQ5j9qUpcr3qnoaVxzTx3SA1ttySqnjpAMPZ+IvqEkn7k80SCYgVq7688nRGTZpnW Wr1hdJobHSMCWT1UPoHmCdGJXs6+qKVf9YugSmapgQ6KfF00uNQQ+62UGbGYpA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782765354; a=rsa-sha256; cv=none; b=Yu+SHgejTDuxsQyWxcrzFFelHrr3l7IKtN64UXbCcxqDuAp/18wHvQWPf59na8OBJz2ntI FWMsMCRTW6whe3aLPBSirhHUN3Kp+q3yKBv+oVqPB04pfD0NIK6cRKCaO07cM0KHHQprU9 tvnmSWL+H3YDcwfzOv5exBN+YfdKN6E4E5mrmEZNg6dTe7gbPdToYacXLI/x9X+Tp+X0c2 JXNMvL+fjVhlkPx4AkOgVEHu7lA98EWP18S0kWLDvZVhPfUEVnbzzBNZX+hmHDbgSRASX0 Jc2zfX1ed5bXenJ1FOs8lWhTV7ZiRoq4K/1/prEpcNzsLnBdAxjjTBSXUKWFRg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782765354; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hXYx61l6Zd6XX9xj75WmFWAAtPfLN8KD3clbmJnYmFU=; b=ugF4IzJtZxEJt6EzPzVpnlham06uSRP+zJL/I43Yg1HinAKQF62IM3UyGio6kxeMKdpH9h UvL9Gho1PtccPaetCRymVZb4jOBrpemQq0ylYbshYLvy3p+Kr2V/7uIIWEbCT8MC4exObf Cjjz/TDKSAQSjVWKGsRfjFTfxhUHfGfh7w39TZelgdzdPPkA+dDRHg/DRnogJHux15W/WE r38TY0X3RYzI/TdfqCZxAruvcXaDeXMW3bBBxiXfmDiLYpDJXcQYlGeRf3nGl/wlXPJSnT pi5vREyMUqwrEWSvR3eJUuQWenqf/wuoXyCMFTkHy3ykuNSS9ntwErj20dMDLg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpyj62Gbjz1CDJ for ; Mon, 29 Jun 2026 20:35:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 26178 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 20:35:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 0ab20f73ca31 - stable/15 - MAC/do: Tests: Add support for exec paths, jail parameters, subjails List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0ab20f73ca31c559881bfbc415b222ab48836eb9 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 20:35:54 +0000 Message-Id: <6a42d72a.26178.7daa4f7f@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=0ab20f73ca31c559881bfbc415b222ab48836eb9 commit 0ab20f73ca31c559881bfbc415b222ab48836eb9 Author: Olivier Certner AuthorDate: 2026-05-22 14:23:31 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:37:10 +0000 MAC/do: Tests: Add support for exec paths, jail parameters, subjails And also allow configuration of the mdo(1) executable path. This commit only contains new or modified infrastructure. No functional change intended at this point. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit a95ff5ef7d1ffcb701913028253a4700cd9a1459) --- tests/sys/mac/do/common.sh | 119 +++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 110 insertions(+), 9 deletions(-) diff --git a/tests/sys/mac/do/common.sh b/tests/sys/mac/do/common.sh index 6c4b138bdac0..4f0e838bbf5f 100644 --- a/tests/sys/mac/do/common.sh +++ b/tests/sys/mac/do/common.sh @@ -10,11 +10,79 @@ rules_parameter() echo "$1".rules } +exec_paths_parameter() +{ + echo "$1".exec_paths +} + +: ${MDO:=/usr/bin/mdo} + +ROOT_KNOB=security.mac.do +RULES_KNOB=$(rules_parameter ${ROOT_KNOB}) +EXEC_PATHS_KNOB=$(exec_paths_parameter ${ROOT_KNOB}) +PPE_KNOB=${ROOT_KNOB}.print_parse_error + +ROOT_JAIL_PARAM=mac.do +RULES_JAIL_PARAM=$(rules_parameter ${ROOT_JAIL_PARAM}) +EXEC_PATHS_JAIL_PARAM=$(exec_paths_parameter ${ROOT_JAIL_PARAM}) + +# To be overridden to execute commands in a sub-jail +JEXEC= + +# Exit status: 0 iff disabled +mac_do_disabled() +{ + [ -z "$($JEXEC sysctl -n ${RULES_KNOB})" ] || + [ -z "$($JEXEC sysctl -n ${EXEC_PATHS_KNOB})" ] +} + +mac_do_check_disabled() +{ + mac_do_disabled || atf_fail "mac_do(4) expected disabled but is not." +} + +mac_do_ensure_disabled() +{ + mac_do_disabled || $JEXEC sysctl ${RULES_KNOB}="" +} + +sysctl_rules() +{ + $JEXEC sysctl -n ${RULES_KNOB} +} + +sysctl_exec_paths() +{ + $JEXEC sysctl -n ${EXEC_PATHS_KNOB} +} + +# $1 = sysctl func, $2 = expected value +sysctl_check() +{ + local func value + + func=$1 + value=$2 + atf_check [ "$($func)" = "$value" ] +} + +# $1 = value +sysctl_check_rules() +{ + local value -CONF_ROOT_KNOB=security.mac.do -RULES_KNOB=$(rules_parameter ${CONF_ROOT_KNOB}) -PPE_KNOB=${CONF_ROOT_KNOB}.print_parse_error + value=$1 + sysctl_check sysctl_rules $value +} +# $1 = value +sysctl_check_exec_paths() +{ + local value + + value=$1 + sysctl_check sysctl_exec_paths $value +} # $1 = knob name, $2 = value sysctl_set_and_check() @@ -23,8 +91,8 @@ sysctl_set_and_check() knob=$1 value=$2 - atf_check -o ignore sysctl "$knob"="$value" - atf_check -o inline:"$value\n" sysctl -n "$knob" + atf_check -o ignore $JEXEC sysctl "$knob"="$value" + atf_check -o inline:"$value\n" $JEXEC sysctl -n "$knob" } # $1 = knob name, $2 = value @@ -35,8 +103,8 @@ sysctl_set_and_check_fails() knob=$1 value=$2 orig_value=$(sysctl -n "$knob") - atf_check -s not-exit:0 -o ignore -e ignore sysctl "$knob"="$value" - atf_check -o inline:"${orig_value}\n" sysctl -n "$knob" + atf_check -s not-exit:0 -o ignore -e ignore $JEXEC sysctl "$knob"="$value" + atf_check -o inline:"${orig_value}\n" $JEXEC sysctl -n "$knob" } # $1 = sysctl function, $2 = value @@ -46,9 +114,9 @@ sysctl_set_and_check_rules_common() func=$1 value=$2 - "$func" ${RULES_KNOB} "$value" - # Same spec but using the older in-rule separator (':') + # Use older in-rule separator (':') first to have final value as specified "$func" ${RULES_KNOB} "$(echo "$value" | sed 's%>%:%')" + "$func" ${RULES_KNOB} "$value" } # $1 = value @@ -69,7 +137,40 @@ sysctl_set_and_check_fails_rules() sysctl_set_and_check_rules_common sysctl_set_and_check_fails "$value" } +# $1 = sysctl function, $2 = value +sysctl_set_and_check_exec_paths_common() +{ + local func value + + func=$1 + value=$2 + # Use older in-rule separator (':') first to have final value as specified + "$func" ${EXEC_PATHS_KNOB} "$(echo "$value" | sed 's%>%:%')" + "$func" ${EXEC_PATHS_KNOB} "$value" +} + +# $1 = value +sysctl_set_and_check_exec_paths() +{ + local value + + value=$1 + sysctl_set_and_check_exec_paths_common sysctl_set_and_check "$value" +} + +# Create a persistent subjail. Echoes its JID. +launch_subjail() +{ + ( + set -o pipefail + $JEXEC jail -c -J /dev/stdout persist=true | + sed -nE 's%^.*jid=([0-9]+).*$%\1%p' + ) || atf_fail "Cannot create a subjail (check children limits?)" +} + atf_require_prog sysctl +atf_require_prog jail +atf_require_prog sed # Do not pollute kernel logs with parse errors sysctl $PPE_KNOB=0 >/dev/null 2>&1