3 ms·

I can't see where in this patch forked children inherit the `ps_tame` from the parent process. I don't know this kernel at all but it seems like something like

I can't see where in this patch forked children inherit the `ps_tame` from the parent process. I don't know this kernel at all but it seems like something like this should be in sys/kern/kern_fork.c pr->ps_tame = parent->ps_tame Otherwise tamed processes could just fork a process to do things they've declared that they won't do.

brynet 11y ago
A tamed process cannot even call fork(2) unless the TAME_PROC flag is passed, in which case I'd assume the child process would then inherit a copy from the parent as part of a normal fork(2) operation. It can be later revoked by the child, but it may want to keep it for kill(2).
- philsnow 11y ago
  I'm `cvs get`ting as fast as I can to read the rest of sys_fork.c to sate my curiosity, but CVS incredibly slow. I'm spoiled by how git packs the repo.
  - philsnow 11y ago
    turned out to be way faster just to grab http://mirrors.sonic.net/pub/OpenBSD/5.7/sys.tar.gz http://mirrors.sonic.net/pub/OpenBSD/5.7/sys.tar.gz , if anybody else wants to poke around and doesn't want to wait for cvs.
    - glass- 11y ago
      You can also view the source on the cvs web mirror: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/ http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/
  - stsp 11y ago
    Sounds like you're doing something unnecessarily more complicated than this: $ time cvs -d anoncvs@anoncvs1.ca.openbsd.org:/cvs export -rHEAD src/sys/kern/kern_fork.c U src/sys/kern/kern_fork.c 0m2.73s real 0m0.06s user 0m0.04s system
    - philsnow 11y ago
      Yep, I was grabbing `src` instead of `src/sys/kern/kern_fork.c`. I've completely forgotten how to CVS, and I'm okay with that.
      - stsp 11y ago
        Perhaps you'll like this, then: https://github.com/ustuehler/git-cvs https://github.com/ustuehler/git-cvs
      - Pyxl101 11y ago
        What are the reasons why CVS is still in use?
        steveklabnik 11y ago
        1. it works 2. they're used to it 3. there isn't enough reason to change 4. lots of infrastructure would need rebuilt if they changed
        stsp 11y ago
        Because we're already too busy with porting our code base to Ruby.
riffraff 11y ago
I wonder if this is related to the "capsicum needs you to rewrite programs" bit. I.e. the capsicum man page explicitly says > Once set, the flag is inherited by future children processes, and may not be cleared. And mentions that specific new APIs should be used in order to manage processes through capabilities.
tedunangst 11y ago
Note that about half of the parent proc struct is simply copied into the child.
- philsnow 11y ago
  Ah yeah, just found that, the patch has a couple lines added to sys/proc.h, + u_int ps_tame; + , right before the end of what's defined as `ps_endcopy`, which is copied from parent to child in `process_initialize`. Makes sense now.

brynet 11y ago

A tamed process cannot even call fork(2) unless the TAME_PROC flag is passed, in which case I'd assume the child process would then inherit a copy from the parent as part of a normal fork(2) operation. It can be later revoked by the child, but it may want to keep it for kill(2).

philsnow 11y ago
I'm `cvs get`ting as fast as I can to read the rest of sys_fork.c to sate my curiosity, but CVS incredibly slow. I'm spoiled by how git packs the repo.
- philsnow 11y ago
  turned out to be way faster just to grab http://mirrors.sonic.net/pub/OpenBSD/5.7/sys.tar.gz http://mirrors.sonic.net/pub/OpenBSD/5.7/sys.tar.gz , if anybody else wants to poke around and doesn't want to wait for cvs.
  - glass- 11y ago
    You can also view the source on the cvs web mirror: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/ http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/
- stsp 11y ago
  Sounds like you're doing something unnecessarily more complicated than this: $ time cvs -d anoncvs@anoncvs1.ca.openbsd.org:/cvs export -rHEAD src/sys/kern/kern_fork.c U src/sys/kern/kern_fork.c 0m2.73s real 0m0.06s user 0m0.04s system
  - philsnow 11y ago
    Yep, I was grabbing `src` instead of `src/sys/kern/kern_fork.c`. I've completely forgotten how to CVS, and I'm okay with that.
    - stsp 11y ago
      Perhaps you'll like this, then: https://github.com/ustuehler/git-cvs https://github.com/ustuehler/git-cvs
    - Pyxl101 11y ago
      What are the reasons why CVS is still in use?
      - steveklabnik 11y ago
        1. it works 2. they're used to it 3. there isn't enough reason to change 4. lots of infrastructure would need rebuilt if they changed
      - stsp 11y ago
        Because we're already too busy with porting our code base to Ruby.

riffraff 11y ago

I wonder if this is related to the "capsicum needs you to rewrite programs" bit. I.e. the capsicum man page explicitly says > Once set, the flag is inherited by future children processes, and may not be cleared. And mentions that specific new APIs should be used in order to manage processes through capabilities.

tedunangst 11y ago

Note that about half of the parent proc struct is simply copied into the child.

philsnow 11y ago
Ah yeah, just found that, the patch has a couple lines added to sys/proc.h, + u_int ps_tame; + , right before the end of what's defined as `ps_endcopy`, which is copied from parent to child in `process_initialize`. Makes sense now.