Changes in Makefile

df68a09ea2ec18ee975fb937d46a18250d4663c8 - tests: sys/capsicum/functional requires mqueuefs

Tue, 27 Jan 2026 01:04:58 +0100

tests: sys/capsicum/functional requires mqueuefsSkip this test if mqueuefs isn't loaded. Unfortunately, that will skipthe entire googletest test program, including test cases that don'trequire mqueuefs. But the test's own skipping logic doesn't work, andwe don't yet have a googletest-compatible require_kmods() function.MFC after: 2 weeksSponsored by: ConnectWiseReviewed by: emaste, ngieDifferential Revision: https://reviews.freebsd.org/D54902 List of files: /freebsd/tests/sys/capsicum/Makefile

670b568ec1c36464c6d55e400382c290b0391ccf - capsicum-test: Move out of contrib

Tue, 27 Jan 2026 14:28:23 +0100

capsicum-test: Move out of contribGoogle developed the Capsicum unit test suite[1] as part of theCapsicum-Linux[2] project, based on unit tests that existed in FreeBSDand unit tests developed as part of the initial Capsicum-Linux port.Capsicum-Linux was archived as of October 31, 2022 and is no longerbeing maintained. FreeBSD is currently the only consumer of andcontributor to the test suite. Move the src into tests/sys/capsicum tosimplify ongoing maintenance.The makefiles were deleted as we (continue to) use the existing bespokeFreeBSD Makefile, and CONTRIBUTING.md was removed as the Google CLA isno longer applicable.[1] https://github.com/google/capsicum-test[2] https://github.com/google/capsicum-linuxReviewed by: asomers, oshogboSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D54917 List of files: /freebsd/tests/sys/capsicum/Makefile

41ece3c036bda3d4da321989ee59d0555c10d603 - capsicum tests: Serialize functional tests

Tue, 03 Sep 2024 16:39:02 +0200

capsicum tests: Serialize functional testsThe test suite runs the same tests twice, as different users, and thesecan trample over each other when run in parallel, causing spurious testfailures.MFC after: 1 week List of files: /freebsd/tests/sys/capsicum/Makefile

e9ac41698b2f322d55ccf9da50a3596edb2c1800 - Remove residual blank line at start of Makefile

Mon, 15 Jul 2024 06:46:32 +0200

Remove residual blank line at start of MakefileThis is a residual of the $FreeBSD$ removal.MFC After: 3 days (though I'll just run the command on the branches)Sponsored by: Netflix List of files: /freebsd/tests/sys/capsicum/Makefile

62d3f57c22eea353dcc3c4a2f70ef72a42a8cd83 - capsicum: add tests for copy_file_range

Thu, 28 Sep 2023 15:27:27 +0200

capsicum: add tests for copy_file_rangeReviewed by: emaste, theraven, kib, markj (all previous version)Differential Revision: https://reviews.freebsd.org/D41967 List of files: /freebsd/tests/sys/capsicum/Makefile

d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf - Remove $FreeBSD$: one-line sh pattern

Wed, 16 Aug 2023 19:55:03 +0200

Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /freebsd/tests/sys/capsicum/Makefile

c826e08841fbcc0ba0c5a78aa09d6ee22a95f2f9 - Fix MK_TESTS build with MK_ASAN/MK_UBSAN

Mon, 02 Aug 2021 10:49:50 +0200

Fix MK_TESTS build with MK_ASAN/MK_UBSANReviewed By: markjDifferential Revision: https://reviews.freebsd.org/D31049 List of files: /freebsd/tests/sys/capsicum/Makefile

955a3f9ad586f38395e66127f9f2f4afbf3d5a94 - Update capsicum-test to git commit f4d97414d48b8f8356b971ab9f45dc5c70d53c40

Tue, 02 Mar 2021 17:28:26 +0100

Update capsicum-test to git commit f4d97414d48b8f8356b971ab9f45dc5c70d53c40This includes various fixes that I submitted recently such as updating thepdkill() tests for the actual implemented behaviour(https://github.com/google/capsicum-test/pull/53) and lots of changes toavoid calling sleep() and replacing it with reliable synchronization(pull requests 49,51,52,53,54). This should make the testsuite more reliablewhen running on Jenkins. Additionally, process status is now retrieved usinglibprocstat instead of running `ps` and parsing the output(https://github.com/google/capsicum-test/pull/50). This fixes one previouslyfailing test and speeds up execution.Overall, this update reduces the total runtime from ~60s to about 4-5 seconds. List of files: /freebsd/tests/sys/capsicum/Makefile

194d5628721f6a306aa94f7e33be909f1ab16b49 - Make capsicum test cases fine-grained

Tue, 06 Oct 2020 08:45:52 +0200

Make capsicum test cases fine-grainedAdd a wrapping script to use ATF to run tests written with Googletestone by one. This helps locating and tracking the failing case in CI easier.This is a temporarily solution while Googletest support in Kyua is developing.We will revert this once Kyua+Googletest integration is ready.Reviewed by: emasteSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D25896 List of files: /freebsd/tests/sys/capsicum/Makefile

7cc42f6d25ef2e19059d088fa7d4853fe9afefb5 - Do a sweep and remove most WARNS=6 settings

Thu, 01 Oct 2020 03:10:51 +0200

Do a sweep and remove most WARNS=6 settingsRepeating the default WARNS here makes it slightly more difficult toexperiment with default WARNS changes, e.g. if we did something absolutelybananas and introduced a WARNS=7 and wanted to try lifting the default tothat.Drop most of them; there is one in the blake2 kernel module, but I suspectit should be dropped -- the default WARNS in the rest of the build doesn'tcurrently apply to kernel modules, and I haven't put too much thought intowhether it makes sense to make it so. List of files: /freebsd/tests/sys/capsicum/Makefile

9a696dc6bb0e8e783dfd169c8299e1f33aac2935 - MFHead@r345880

Thu, 04 Apr 2019 20:26:32 +0200

MFHead@r345880 List of files: /freebsd/tests/sys/capsicum/Makefile

8ac5aef8f354384d727d3d25b8d4c195596647c1 - Integrate capsicum-test into the FreeBSD test suite

Mon, 01 Apr 2019 23:24:50 +0200

Integrate capsicum-test into the FreeBSD test suiteThis change takes capsicum-test from upstream and applies some local changes to make thetests work on FreeBSD when executed via Kyua.The local modifications are as follows:1. Make `OpenatTest.WithFlag` pass with the new dot-dot lookup behavior in FreeBSD 12.x+.2. capsicum-test references a set of helper binaries: `mini-me`, `mini-me.noexec`, and `mini-me.setuid`, as part of the execve/fexecve tests, via execve, fexecve, and open. It achieves this upstream by assuming `mini-me*` is in the current directory, however, in order for Kyua to execute `capsicum-test`, it needs to provide a full path to `mini-me*`. In order to achieve this, I made `capsicum-test` cache the executable's path from argv[0] in main(..) and use the cached value to compute the path to `mini-me*` as part of the execve/fexecve testcases.3. The capsicum-test test suite assumes that it's always being run on CAPABILITIES enabled kernels. However, there's a chance that the test will be run on a host without a CAPABILITIES enabled kernel, so we must check for the support before running the tests. The way to achieve this is to add the relevant `feature_present("security_capabilities")` check to SetupEnvironment::SetUp() and skip the tests when the support is not available. While here, add a check for `kern.trap_enotcap` being enabled. As noted by markj@ in https://github.com/google/capsicum-test/issues/23, this sysctl being enabled can trigger non-deterministic failures. Therefore, the tests should be skipped if this sysctl is enabled.All local changes have been submitted to the capsicum-test project(https://github.com/google/capsicum-test) and are in various stages of review.Please see the following pull requests for more details:1. https://github.com/google/capsicum-test/pull/352. https://github.com/google/capsicum-test/pull/413. https://github.com/google/capsicum-test/pull/42Reviewed by: asomersDiscussed with: emaste, markjApproved by: emaste (mentor)MFC after: 2 monthsDifferential Revision: https://reviews.freebsd.org/D19758 List of files: /freebsd/tests/sys/capsicum/Makefile

08e5c473f1d1a3a8fa30bfb5c5181c1a2e08c9f2 - Skip test if feature security_capabilities is not available

Fri, 29 Mar 2019 09:43:21 +0100

Skip test if feature security_capabilities is not availablePR: 236863Approved by: asomersMFC after: 1 monthSponsored by: Netflix List of files: /freebsd/tests/sys/capsicum/Makefile

2216c6933cf09bd4922b49e9d5fd9a7e48b056a5 - Disable connectat/bindat with AT_FDCWD in capmode

Mon, 30 Apr 2018 19:31:06 +0200

Disable connectat/bindat with AT_FDCWD in capmodePreviously it was possible to connect a socket (which had theCAP_CONNECT right) by calling "connectat(AT_FDCWD, ...)" even incapabilties mode. This combination should be treated the same as a callto connect (i.e. forbidden in capabilities mode). Similarly for bindat.Disable connectat/bindat with AT_FDCWD in capabilities mode, fix up thedocumentation and add tests.PR: 222632Submitted by: Jan Kokemüller Reviewed by: Domagoj StolfaMFC after: 1 weekRelnotes: YesDifferential Revision: https://reviews.freebsd.org/D15221 List of files: /freebsd/tests/sys/capsicum/Makefile

8ce99bb405605db973671c663fa6e5ef287ec3fb - Properly do a deep copy of the ioctls capability array for fget_cap().

Tue, 17 Apr 2018 20:07:40 +0200

Properly do a deep copy of the ioctls capability array for fget_cap().fget_cap() tries to do a cheaper snapshot of a file descriptor withoutholding the file descriptor lock. This snapshot does not do a deepcopy of the ioctls capability array, but instead uses a differentreturn value to inform the caller to retry the copy with the lockheld. However, filecaps_copy() was returning 1 to indicate that aretry was required, and fget_cap() was checking for 0 (actually'!filecaps_copy()'). As a result, fget_cap() did not do a deep copyof the ioctls array and just reused the original pointer. This causemultiple file descriptor entries to think they owned the same pointerand eventually resulted in duplicate frees.The only code path that I'm aware of that triggers this is to create alisten socket that has a restricted list of ioctls and then callaccept() which calls fget_cap() with a valid filecaps structure fromgetsock_cap().To fix, change the return value of filecaps_copy() to return true ifit succeeds in copying the caps and false if it fails because the lockis required. I find this more intuitive than fixing the caller inthis case. While here, change the return type from 'int' to 'bool'.Finally, make filecaps_copy() more robust in the failure case by notcopying any of the source filecaps structure over. This avoids thepossibility of leaking a pointer into a structure if a similar futurecaller doesn't properly handle the return value from filecaps_copy()at the expense of one more branch.I also added a test case that panics before this change and now passes.Reviewed by: kibDiscussed with: mjg (not a fan of the extra branch)MFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D15047 List of files: /freebsd/tests/sys/capsicum/Makefile