Page MenuHomeFreeBSD
Differential D30334

protect.1: document existence of _oomprotect
ClosedPublic
Actions

Authored by debdrup on May 18 2021, 2:25 PM.
Tags
Referenced Files
Unknown Object (File)
Sat, Nov 16, 11:39 AM
Unknown Object (File)
Thu, Nov 14, 5:52 PM
Unknown Object (File)
Thu, Nov 14, 1:08 AM
Unknown Object (File)
Tue, Nov 12, 7:20 PM
Unknown Object (File)
Mon, Nov 11, 7:17 AM
Unknown Object (File)
Sun, Nov 10, 6:55 PM
Unknown Object (File)
Sat, Nov 9, 10:23 AM
Unknown Object (File)
Sat, Nov 9, 7:03 AM
View All 72 Files
Subscribers
emaste
imp

Details

Reviewers
a.wolk_fudosecurity.com
Commits
rG8136944bb975: protect.1: document existence of _oomprotect
rG16a44c124272: protect.1: document existence of _oomprotect
rGc8b6be0f7d1b: protect.1: document existence of _oomprotect
Summary

Documenation related to the recent addition in https://reviews.freebsd.org/D30330

There is also no documentation on how to check whereas protect(1) works. This is possible to obtain by inspecting the output of ps -O flags,flags2 and knowing which bits in the bitmask correspond to -i and protect. Should we document it here also?

Suggested commit message:

commit 2aba7677d77e795613a9fe1516b3733941f7c012 (HEAD -> main)
Author: Adam Wolk <a.wolk@fudosecurity.com>
Date:   Tue May 18 16:19:18 2021 +0200

    protect.1: document existence of _oomprotect
    
    Improve discoverability of the functionality by mentioning in the userland tool
    manual. Add a SEE ALSO entry to rc.conf(5) where more details are provided.
    
    Sponsored by:   Fudo Security

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

a.wolk_fudosecurity.com requested review of this revision.May 18 2021, 2:25 PM
a.wolk_fudosecurity.com created this revision.
debdrup added a comment.May 18 2021, 2:30 PM

Yes, it would be good to have a documented method of checking the protected flag, so go ahead and add that.

Once ready, I'll push this along with the other commit.

a.wolk_fudosecurity.com added a comment.May 18 2021, 2:37 PM
In D30334#681210, @debdrup wrote:

Yes, it would be good to have a documented method of checking the protected flag, so go ahead and add that.

Once ready, I'll push this along with the other commit.

Word of warning. This is a pretty barebones method that relies on knowing the magic values.

This would be something akin to:

In order to check if protect is properly applied to processes
one can use ps -O flags,flags2 -p pid and read the bits:

root@aw:~ # grep PROTECT /usr/include/sys/proc.h
#define P_PROTECTED     0x100000 /* Do not kill on memory overcommit. */
#define P2_INHERIT_PROTECTED 0x00000001 /* New children get P_PROTECTED. */ 

+ /usr/bin/protect -i su -m awolk -c ./main
 P: 64430
  PID        F       F2 TT  STAT    TIME COMMAND
64430 10104002 00000001  5  S+   0:00.00 ./main

Do we still want that in and if so what level of assumptions should I make? Should I show the grep or just state that nth bit corresponds to the setting?

a.wolk_fudosecurity.com updated this revision to Diff 89424.May 18 2021, 3:35 PM

Document how to obtain the current protection status using ps(1).

Updated suggested commit message:

commit 5461eebe63f10fdcee015fa4b43cc0c5827691fe
Author: Adam Wolk <a.wolk@fudosecurity.com>
Date:   Tue May 18 16:19:18 2021 +0200

    protect.1: document existence of _oomprotect
    
    Improve discoverability of the functionality by mentioning in the userland tool
    manual. Add a SEE ALSO entry to rc.conf(5) where more details are provided.
    
    While here document how to obtain the current protection status using ps(1).
    
    Sponsored by:   Fudo Security
a.wolk_fudosecurity.com updated this revision to Diff 89427.May 18 2021, 3:53 PM

Make the pid used in ps(1) call match the sample output.

debdrup mentioned this in D30336: rc.subr.8: document argument_cmd override pitfalls.May 18 2021, 4:02 PM
a.wolk_fudosecurity.com updated this revision to Diff 89432.May 18 2021, 4:12 PM

Updated the raw diff using the git show -U999999 <commit-hash> > change.diff method.

debdrup added a comment.May 18 2021, 4:37 PM

Have you tested with textproc/igor and mandoc -T lint?

usr.bin/protect/protect.1
93
101
a.wolk_fudosecurity.com added a comment.May 18 2021, 4:39 PM
In D30334#681326, @debdrup wrote:

Have you tested with textproc/igor and mandoc -T lint?

I have not. Updating manpages is not something I frequently do so I was not aware of the tools/functionality. Will run it on both reviews in a bit.

a.wolk_fudosecurity.com updated this revision to Diff 89434.May 18 2021, 4:49 PM

Includes changes suggested by @debdrup and ran the tool against igor and mandoc -T lint fixing reported problems.

a.wolk_fudosecurity.com updated this revision to Diff 89436.May 18 2021, 4:53 PM

Fixed one more sentence not started on a new line.

emaste added a subscriber: emaste.Nov 12 2021, 9:41 PM
debdrup commandeered this revision.Apr 11 2022, 10:23 PM
debdrup edited reviewers, added: a.wolk_fudosecurity.com; removed: debdrup.

I apologize deeply for losing track of this one (and the change to rc.subr(8), although I think I managed to address that one).

I've gone over it again, and I'm happy with it now, so I'll go ahead and do the needful. Hopefully it's better late than never. :)

This revision was not accepted when it landed; it landed in state Needs Review.Apr 11 2022, 10:26 PM
Closed by commit rGc8b6be0f7d1b: protect.1: document existence of _oomprotect (authored by a.wolk_fudosecurity.com, committed by debdrup). · Explain Why
This revision was automatically updated to reflect the committed changes.
debdrup added a commit: rGc8b6be0f7d1b: protect.1: document existence of _oomprotect.
Herald added a subscriber: imp. · View Herald TranscriptApr 11 2022, 10:26 PM
0mp added a commit: rG16a44c124272: protect.1: document existence of _oomprotect.Jul 21 2022, 11:58 PM
0mp added a commit: rG8136944bb975: protect.1: document existence of _oomprotect.

Revision Contents
Changeset List

PathSize
usr.bin/
protect/
32 lines

Diff 104893

View Options

usr.bin/protect/protect.1

Loading...