Asymmetric keyrings can require key payloads to be X.509 certificates
signed by a key in a different keyring. This can be helpful for rotating
keys on a live machines for subsystems like IMA while preventing local
tampering.
Tested locally by applying the "key_or_keyring:<id>" restriction to a
keyring.
Change-Id: Ia8dcb343abc5f405d374c357d5cac3d5181d7159
Reviewed-on: https://go-review.googlesource.com/c/sys/+/178400
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
Adds initial constants and types to use with SockaddrTIPC. For more
information on TIPC, see: http://tipc.sourceforge.net/.
Because the C struct sockaddr_tipc makes use of a union for its addr
field, I have created a wrapping layer in SockaddrTIPC that uses
an interface to determine which variant is in use.
Tests accompany this change due to the complexity of this code. There
is currently little test coverage in the Sockaddr-related code, but
perhaps this is something that could be picked up as a relatively
straightforward task for a new contributor.
Change-Id: I5033a0685cb7128d4b1a23d18aca71c202d0c0aa
Reviewed-on: https://go-review.googlesource.com/c/sys/+/187960
Run-TryBot: Matt Layher <mdlayher@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Add IoctlRetInt() for ioctls that use syscall's return value
as an output parameter. Add a unit test for Linux, and the
NS_GET_ defines that it requires (see ioctl_ns(2)).
Motivation:
Currently, x/sys/unix provides a few functions to deal with ioctls.
In particular, IoctlGetInt(), which "performs an ioctl operation
which gets an integer value". It does that by passing a pointer
to an integer to a syscall and returning that integer. The value
returned from syscall is treated as success/failure flag
(0 means success, -1 means failure, and in such case errno
is used to figure out the underlying error).
It appears that there are a few ioctls in Linux and at least one
in Solaris, which do not use the above way to return an int, instead
they use the syscall's return value (in case it's not negative).
As Linux ioctl(2) man page says,
> RETURN VALUE
> Usually, on success zero is returned. A few ioctl() requests
> use the return value as an output parameter and return
> a nonnegative value on success. On error, -1 is returned,
> and errno is set appropriately.
Currently I am aware of at least 6 Linux ioctls that do that
(return the value directly):
* LOOP_CTL_* ioctls on /dev/loop-control (all 3 of them). Source: loop(4)
* NS_* ioctls (3 out of 4) on /proc/PID/ns/*. Source: ioctl_ns(2)
And one in Solaris:
* I_FIND ioctl, source: streamio(7i).
There might be some more ioctls like the ones above, but since
ioctls are scarcely documented, it is hard to say how many more.
Obviously, using IoctlGetInt() for such ioctls would be a big
mistake, as 0 will always be returned. For example, there was
a bug in Docker's pkg/loopback (moby/moby#39801).
[v6: make it linux-specific for now]
Fixesgolang/go#33966
Change-Id: Ie64f72fd84101b955ba14519a357e06a66d685d0
Reviewed-on: https://go-review.googlesource.com/c/sys/+/192780
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
Implement ParseDirent in x/sys/unix instead of calling
syscall.ParseDirent. The latter uses offsets into syscall.Dirent which
might not be matching unix.Dirent depending on Go version. This is e.g.
the case with of FreeBSD whose Dirent structure was updated for Go 1.12.
This fixes TestDirent and TestGetdirentries on freebsd with Go 1.11
Reverts CL 88475
Change-Id: I04318f59c6fbf148c75ce3667255a0c0428288e2
Reviewed-on: https://go-review.googlesource.com/c/sys/+/183897
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Benny Siegert <bsiegert@gmail.com>
Provide common implementation for ReadDirent based on Getdents for
aix, *bsd and linux.
Add Getdents on aix as a wrapper around getdirent.
Keep the implementation for ReadDirent based on Getdirentries for
darwin and dragonfly.
Change-Id: I09094156a1452118ba48af4f14dfe44b1ab745d3
Reviewed-on: https://go-review.googlesource.com/c/sys/+/182321
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Benny Siegert <bsiegert@gmail.com>
The kernel raw syscall takes an additional parameter specifying
the size of the Sigset_t parameter, returns a file descriptor and sets errno.
Add a uintptr maxSize parameter, adjust the return to be (newfd int, err error).
Add the _NSIG #define and a wrapper to call with maxSize set to _C__NSIG/8 as done
in glibc/musl.
Change-Id: I277db0aab5c12364533c26ea800b7f394ec83ae4
Reviewed-on: https://go-review.googlesource.com/c/sys/+/178858
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Because the size of int varies on different architectures,
IoctlGetInt is unsuitable for ioctl APIs which explicitly deal with
fixed size integers, such as uint32.
Change-Id: I5a8dc397b713027c4ef9f9a91490f177ac8342e2
Reviewed-on: https://go-review.googlesource.com/c/sys/+/175982
Run-TryBot: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
This adds wrappers around name_to_handle_at and open_by_handle_at.
Requires root (or CAP_DAC_READ_SEARCH, rather) to run tests, which at
least some of our builders have.
bradfitz@go:~/src/golang.org/x/sys/unix$ go test -c && sudo ./unix.test -test.run=OpenBy -test.v=true
=== RUN TestOpenByHandleAt
=== RUN TestOpenByHandleAt/clone=false
=== RUN TestOpenByHandleAt/clone=true
--- PASS: TestOpenByHandleAt (0.00s)
syscall_linux_test.go:546: mountID: 22, handle: size=8, type=1, bytes="\x9e\x1e\b\x00~\x8c\xe5\x9d"
--- PASS: TestOpenByHandleAt/clone=false (0.00s)
syscall_linux_test.go:568: opened fd 3
--- PASS: TestOpenByHandleAt/clone=true (0.00s)
syscall_linux_test.go:568: opened fd 3
PASS
Fixesgolang/go#30537
Change-Id: Ia48a8faab2fee665d88a16d81a3a0c1504b129ce
Reviewed-on: https://go-review.googlesource.com/c/sys/+/173357
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Add GetsockoptTpacketStats and GetsockoptTpacketStatsV3 to get tpacket
statistics (for TPACKET_V2 and TPACKET_V3).
Add SetsockoptTpacketReq and SetsockoptTpacketReq3 to set up tpacket
v2/v3 ring buffers.
Change-Id: Ic2870be22be7d74141f682e515a682df28e1c814
Reviewed-on: https://go-review.googlesource.com/c/sys/+/165558
Reviewed-by: Ian Lance Taylor <iant@golang.org>
This teaches unix/mksyscall.go about mapping uint64 to syscall
arguments, similar to existing handling of int64.
Change-Id: I536b4b09bbf6a8e3016565a4a04d2b9d32cbc624
Reviewed-on: https://go-review.googlesource.com/c/164664
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
Adding this helper enables me to eliminate some nasty code which
invokes unix.Syscall6 directly, and which has 32-bit shims for
invoking setsockopt properly on 32-bit Linux.
Change-Id: I53ef411e4c96cef557999261760cddc00df58d8a
Reviewed-on: https://go-review.googlesource.com/c/163303
Run-TryBot: Matt Layher <mdlayher@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
On linux/riscv64, the renameat syscall no longer exists and has been
superseded by renameat2. Use Renameat2 to implement Renameat on
linux/riscv64.
Based on a patch by Ryan O'Leary.
Updates golang/go#27532
Change-Id: I7c60c7f824750408265f67397b8ac1fa7226f425
Reviewed-on: https://go-review.googlesource.com/c/157899
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Passing an empty iovs []Iovec slice to Vmsplice leads to an index out of
range panic. Fix this by passing an nil unsafe.Pointer to the underlying
syscall in case of an empty slice.
Change-Id: If1844c1b2eb0833de598aed7e79b9fcf061f7975
Reviewed-on: https://go-review.googlesource.com/c/153317
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
IoctlSetPointerInt is necessary for interacting with the PPP kernel
driver, which wants it passed as a pointer to int, rather than the
more conventional int cast as a pointer.
We can technically do this already with
IoctlSetInt(int(uintptr(unsafe.Pointer(&foo)))), but that's just
masking the operation we're trying to execute in the first place,
and relying on the internals of IoctlSetInt to do the right
inverse transformation.
Change-Id: I1e6a1dd6190c11f06c6f5393cd2cae453939878a
GitHub-Last-Rev: a88f56073d
GitHub-Pull-Request: golang/sys#25
Reviewed-on: https://go-review.googlesource.com/c/150321
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Export the sizeof(Ptr|Short|Int|Long|LongLong) consts. This allows users
to get this information (e.g. for alignment purposes) without using cgo
or generating these constants themselves.
Change-Id: I8640482bf67b89c2f2b6e9a116ba7bc268f8135a
Reviewed-on: https://go-review.googlesource.com/c/139617
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Renameat2 is Linux-specific and allows to pass an additional flags
argument to the renameat syscall. Also add the corresponding RENAME_*
flag mask values.
Change-Id: Ib4baa46fdd0b07ccd0988ac624862ce69d5c3ad5
Reviewed-on: https://go-review.googlesource.com/127763
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
The Linux kernel faccessat system call does not take a flags parameter.
The flag parameter to the C library faccessat function is implemented in C.
The unix.Faccessat function takes a flags parameter. In older releases
we have passed the flags parameter to the kernel, which ignored it.
In CL 119495 we started returning an error if any flags were set.
That seems clearly better than ignoring them, but it turns out that some
code was using the flags. The code was previously subtly broken.
Now it is obviously broken. That is better, but we can do better still:
we can implement the flags as the C library does. That is what this CL does.
Change-Id: I02d4bb981ebd39eb35e47c6e5281f85eaea68016
Reviewed-on: https://go-review.googlesource.com/126516
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
On linux/arm64 we used to manually define syscall numbers for some
deprecated syscalls. Most of them are unused by now anyhow. Convert the
remaining syscall wrappers using them to implement the respective
functionality using a non-deprecated syscall (in the same way glibc does
it):
- Implement EpollCreate using EpollCreate1 and additionally check
that the passed size argument is larger than 0.
- Implement Futimesat and utimes using utimensat. Also change futimesat
on the other geese to take a string instead of *byte and let the
generated wrapper do the BytePtrFromString conversion.
- Return ENOSYS from Ustat. The ustat syscall has been deprecated for a
long time in favor of fstatfs and statfs. Even glibc will deprecate
ustat in the upcoming 2.28 release [1].
[1] https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;h=d51fa09544f03899b7ff5a80569db088c3c23c28;hb=HEAD#l90
Change-Id: I7ea38a3cd394b0875f17443b14e107fd9c70350d
Reviewed-on: https://go-review.googlesource.com/119655
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
By simply rearranging the logic, we avoid the overhead of a superfluous
call to getsockopt. For, if p is already non empty, there's no point
in having to check if we need to attach dummy payload. This has
performance benefits when using send/recvmsg for high speed
communications.
Change-Id: If47ab5322464aad8e6d2603a369e95327223211f
Reviewed-on: https://go-review.googlesource.com/108337
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
This adds a wrapper around perf_event_open, exported constants and
two structs:
- perf_event_attr, used to configure the syscall
- perf_event_mmap_page to coordinate the kernel's mmap ring buffer
Change-Id: Ife7ded8344de9e3eb74441bd51ab9a04c81b4965
Reviewed-on: https://go-review.googlesource.com/105756
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Move the common Getsockopt* implementations to syscall_unix.go instead
of duplicating them in syscall_bsd.go and syscall_linux.go. This also
makes all of them available on Solaris and adds GetsockoptByte on Linux.
Change-Id: Ibf49b27be46be579e63e3b3e2ebc1504e5228d5f
Reviewed-on: https://go-review.googlesource.com/104695
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Add rudimentary godoc for all existing Sockaddr* types implementing the
Sockaddr interface.
Change-Id: Ida7d1e8756477b54fc773f4bc978002c3d4a376d
Reviewed-on: https://go-review.googlesource.com/89775
Reviewed-by: Ian Lance Taylor <iant@golang.org>
statx(2) allows to get enhanced file status information (not currently
available through the existing stat syscalls), lightweight stat,
heavyweight stat. The Statx_t type used by Statx has consistent field
sizes on all arches (with year-2038-capable timestamps) and is closer to
the BSD implementation of Stat_t.
See http://man7.org/linux/man-pages/man2/statx.2.html for details. The
syscall was added in Linux kernel 4.11.
See https://github.com/tklauser/statx for an example of how this
function and types can be used to report stat(1)-like file status
information.
Change-Id: I9e9642b5b42a393f94fd532453888ce9ba4f0003
Reviewed-on: https://go-review.googlesource.com/87555
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
