From nobody Wed Aug 20 10:46:23 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4c6NRN0fgLz64l7y; Wed, 20 Aug 2025 10:46:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4c6NRM70dcz45F8; Wed, 20 Aug 2025 10:46:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1755686784; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ktcSWMcFxaE69B9tnjYensGeI09WIODeRGavwhgJ6vA=; b=qZxTucKnG4ZrEGquK+C2AtdFp22K8+ZGwXgb8vShWm+fw/Czl/3idKTWnFLmYuQ2aT/JOe jzYkGhSMaXaE6EF0ObePDbpe73LWkjG+qnUMG72ZVQHH+pQRX4vMwc6FfrAmol1TTzpNmf Jle9G14nmJXhWeNmqYRgk+efQ6BHWCgEOmtgi7uopJ5DxSDp3VSF1OMCIt+V56pKVFx+ZK HgztoVW3UlDZoRFvVVRGKfuY+VSJNxoshN5mOyYVhYeYvjMEhZK3F2Tvq/2dz+edbuVusm ajsAgGJqTVN/Zhkm8ESFmh7Zy09lGJOq+busckll9g70pXyzG6bdt2llM+Y2fQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1755686784; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ktcSWMcFxaE69B9tnjYensGeI09WIODeRGavwhgJ6vA=; b=Tf/DXbUxwFMfWdcSSL4rwFIdbGRIxDwmsgS3T5LR3Zks1iMLXhtB4p/UWgQPLMrVWtxjFg KSUUqflAJhbKH/MMFgB/uee8B7xM9IJRtzFPU/Mm5Vn3/oIlUdZEMUW7LMqeejt7IthW1l gB4WZnI9lD+/+xKIb39dhFaYrBbr+tXV3Vh0XPnODMeaf5vzm6cJyBeQKyhgDpEgsSzDWn r/YuQpKuNMnTlRqbWtLKmNF8QPe/9Y4ylEWnHLtY9hWr+bJ0apx+yVVK5vwo+7wq8a8Sgx y5P8qj8xXpwvPMi1aWAbqBpFROpFRxhTpw73wis1tLuYlhSD9Aiu4nnEOsWH/w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1755686784; a=rsa-sha256; cv=none; b=YQsskVPgZh4tLO4FEf1E/mS7cVT/ODL9mG8KaRbznH8f3XquAX8+rYiCvXc+mcfFXjfav+ eiG7mPjR98uuVsQySWBvBzATTzKf4ryt7wUU+DiJ6QIN54y8s9dyO9sL6c6tJy/fhsPd2c jTI7u7Ef0/evkMgo+PJELWlrRjC3KhJCyMCUImoQPDDjnrFrYp1NRhqlTH3gF7VnTFvqWx EJOqDmyO35GdSJIySnijPeP8ua9bQWHJ33IdqlUFYCO7SA1MUrjKxZVdZjQR10HhM8eYRc Geop3sPoNWeRwXtg6c4k+7sp3kIOHTrRei1y/tYkM1znY7MrZBaEYc14Vvo51w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4c6NRM6YGdz18Yb; Wed, 20 Aug 2025 10:46:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 57KAkNmA058179; Wed, 20 Aug 2025 10:46:23 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 57KAkN54058176; Wed, 20 Aug 2025 10:46:23 GMT (envelope-from git) Date: Wed, 20 Aug 2025 10:46:23 GMT Message-Id: <202508201046.57KAkN54058176@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mateusz Piotrowski <0mp@FreeBSD.org> Subject: git: b09a75d675dc - stable/14 - dtrace.1: Document security.bsd.allow_destructive_dtrace List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: 0mp X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: b09a75d675dcaa9a1e5dcc63f7cfbb5df85419e6 Auto-Submitted: auto-generated The branch stable/14 has been updated by 0mp: URL: https://cgit.FreeBSD.org/src/commit/?id=b09a75d675dcaa9a1e5dcc63f7cfbb5df85419e6 commit b09a75d675dcaa9a1e5dcc63f7cfbb5df85419e6 Author: Mateusz Piotrowski <0mp@FreeBSD.org> AuthorDate: 2025-08-01 15:23:20 +0000 Commit: Mateusz Piotrowski <0mp@FreeBSD.org> CommitDate: 2025-08-20 10:46:18 +0000 dtrace.1: Document security.bsd.allow_destructive_dtrace PR: 288284 Reviewed by: bcr, markj MFC after: 3 days Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D51633 (cherry picked from commit 1acfb873cf2e59f9ddf53602cbc67fa810c878a6) --- cddl/contrib/opensolaris/cmd/dtrace/dtrace.1 | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/cddl/contrib/opensolaris/cmd/dtrace/dtrace.1 b/cddl/contrib/opensolaris/cmd/dtrace/dtrace.1 index 0603a32da5e2..eafc25f187d5 100644 --- a/cddl/contrib/opensolaris/cmd/dtrace/dtrace.1 +++ b/cddl/contrib/opensolaris/cmd/dtrace/dtrace.1 @@ -20,7 +20,7 @@ .\" .\" $FreeBSD$ .\" -.Dd July 16, 2025 +.Dd July 30, 2025 .Dt DTRACE 1 .Os .Sh NAME @@ -537,6 +537,17 @@ option is not specified, .Nm does not permit the compilation or enabling of a D program that contains destructive actions. +.Pp +Set the +.Va security.bsd.allow_destructive_dtrace +.Xr loader 8 +tunable +to +.Ql 0 +to disallow the possibility of enabling destructive actions system-wide at any point at all. +Any attempts to enable destructive actions will cause +.Nm +to exit with a runtime error. .It Fl x Ar arg Op Ns = Ns value Enable or modify a DTrace runtime option or D compiler option. Boolean options are enabled by specifying their name. @@ -1219,6 +1230,18 @@ failed or that the specified request could not be satisfied. .It 2 Invalid command line options or arguments were specified. .El +.Sh DIAGNOSTICS +.Bl -diag +.It dtrace: could not enable tracing: Permission denied +This can happen when +.Nm +fails to enable destructive actions because +.Va security.bsd.allow_destructive_dtrace +is set to +.Ql 0 +in +.Xr loader.conf 5 . +.El .Sh SEE ALSO .Xr cpp 1 , .Xr dtrace_audit 4 ,