Hi,
The following diff changes (but not too much) the way printf debug is
done in kern_unveil.c
Currently, each printf() is enclosed in #ifdef DEBUG_UNVEIL. The diff
moves to using DPRINTF(). It reduces the number of #ifdef inside the
file.
I also changed some strings to use __func__ instead of using the
function name verbatim.
Build tested with and without DEBUG_UNVEIL defined.
No intented changes.
Comments or OK ?
--
Sebastien Marie
diff de3a27964b222c4be979b46c1662d48f67059711 /home/semarie/repos/openbsd/src
blob - 50a043e63d5ae40167428b894994ae10f5b705c1
file + sys/kern/kern_unveil.c
--- sys/kern/kern_unveil.c
+++ sys/kern/kern_unveil.c
@@ -56,6 +56,11 @@ struct unveil {
};
/* #define DEBUG_UNVEIL */
+#ifdef DEBUG_UNVEIL
+#define DPRINTF(x...) do { printf(x); } while (0)
+#else
+#define DPRINTF(x...)
+#endif
#define UNVEIL_MAX_VNODES 128
#define UNVEIL_MAX_NAMES 128
@@ -103,9 +108,8 @@ unveil_delete_names(struct unveil *uv)
ret++;
}
rw_exit_write(&uv->uv_lock);
-#ifdef DEBUG_UNVEIL
- printf("deleted %d names\n", ret);
-#endif
+
+ DPRINTF("deleted %d names\n", ret);
return ret;
}
@@ -120,9 +124,8 @@ unveil_add_name_unlocked(struct unveil *uv, char *name
unvname_delete(unvn);
return 0;
}
-#ifdef DEBUG_UNVEIL
- printf("added name %s underneath vnode %p\n", name, uv->uv_vp);
-#endif
+
+ DPRINTF("added name %s underneath vnode %p\n", name, uv->uv_vp);
return 1;
}
@@ -144,10 +147,8 @@ unveil_namelookup(struct unveil *uv, char *name)
rw_enter_read(&uv->uv_lock);
-#ifdef DEBUG_UNVEIL
- printf("unveil_namelookup: looking up name %s (%p) in vnode %p\n",
- name, name, uv->uv_vp);
-#endif
+ DPRINTF("%s: looking up name %s (%p) in vnode %p\n",
+ __func__, name, name, uv->uv_vp);
KASSERT(uv->uv_vp != NULL);
@@ -158,14 +159,9 @@ unveil_namelookup(struct unveil *uv, char *name)
rw_exit_read(&uv->uv_lock);
-#ifdef DEBUG_UNVEIL
- if (ret == NULL)
- printf("unveil_namelookup: no match for name %s in vnode %p\n",
- name, uv->uv_vp);
- else
- printf("unveil_namelookup: matched name %s in vnode %p\n",
- name, uv->uv_vp);
-#endif
+ DPRINTF("%s: %s name %s in vnode %p\n", __func__,
+ (ret == NULL) ? "no match for" : "matched",
+ name, uv->uv_vp);
return ret;
}
@@ -181,11 +177,10 @@ unveil_destroy(struct process *ps)
/* skip any vnodes zapped by unveil_removevnode */
if (vp != NULL) {
vp->v_uvcount--;
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): removing vnode %p uvcount %d "
+
+ DPRINTF("unveil: %s(%d): removing vnode %p uvcount %d "
"in position %ld\n",
ps->ps_comm, ps->ps_pid, vp, vp->v_uvcount, i);
-#endif
vrele(vp);
}
ps->ps_uvncount -= unveil_delete_names(uv);
@@ -291,7 +286,7 @@ unveil_find_cover(struct vnode *dp, struct proc *p)
* This corner case should not happen because
* we have not set LOCKPARENT in the flags
*/
- printf("vnode %p PDIRUNLOCK on error\n", vp);
+ DPRINTF("vnode %p PDIRUNLOCK on error\n", vp);
vrele(vp);
}
break;
@@ -372,9 +367,7 @@ unveil_setflags(u_char *flags, u_char nflags)
{
#if 0
if (((~(*flags)) & nflags) != 0) {
-#ifdef DEBUG_UNVEIL
- printf("Flags escalation %llX -> %llX\n", *flags, nflags);
-#endif
+ DPRINTF("Flags escalation %llX -> %llX\n", *flags, nflags);
return 1;
}
#endif
@@ -465,11 +458,10 @@ unveil_add(struct proc *p, struct nameidata *ndp, cons
* unrestrict it.
*/
if (directory_add) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): updating directory vnode %p"
+ DPRINTF("unveil: %s(%d): updating directory vnode %p"
" to unrestricted uvcount %d\n",
pr->ps_comm, pr->ps_pid, vp, vp->v_uvcount);
-#endif
+
if (!unveil_setflags(&uv->uv_flags, flags))
ret = EPERM;
else
@@ -485,12 +477,11 @@ unveil_add(struct proc *p, struct nameidata *ndp, cons
struct unvname *tname;
if ((tname = unveil_namelookup(uv,
ndp->ni_cnd.cn_nameptr)) != NULL) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): changing flags for %s"
+ DPRINTF("unveil: %s(%d): changing flags for %s"
"in vnode %p, uvcount %d\n",
pr->ps_comm, pr->ps_pid, tname->un_name, vp,
vp->v_uvcount);
-#endif
+
if (!unveil_setflags(&tname->un_flags, flags))
ret = EPERM;
else
@@ -516,11 +507,10 @@ unveil_add(struct proc *p, struct nameidata *ndp, cons
if (directory_add) {
uv->uv_flags = flags;
ret = 0;
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): added unrestricted directory vnode %p"
+
+ DPRINTF("unveil: %s(%d): added unrestricted directory vnode %p"
", uvcount %d\n",
pr->ps_comm, pr->ps_pid, vp, vp->v_uvcount);
-#endif
goto done;
}
@@ -528,13 +518,11 @@ unveil_add(struct proc *p, struct nameidata *ndp, cons
pr->ps_uvncount++;
ret = 0;
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): added name %s beneath %s vnode %p,"
+ DPRINTF("unveil: %s(%d): added name %s beneath %s vnode %p,"
" uvcount %d\n",
pr->ps_comm, pr->ps_pid, ndp->ni_cnd.cn_nameptr,
uv->uv_flags ? "unrestricted" : "restricted",
vp, vp->v_uvcount);
-#endif
done:
return ret;
@@ -548,40 +536,30 @@ int
unveil_flagmatch(struct nameidata *ni, u_char flags)
{
if (flags == 0) {
-#ifdef DEBUG_UNVEIL
- printf("All operations forbidden for 0 flags\n");
-#endif
+ DPRINTF("All operations forbidden for 0 flags\n");
return 0;
}
if (ni->ni_unveil & UNVEIL_READ) {
if ((flags & UNVEIL_READ) == 0) {
-#ifdef DEBUG_UNVEIL
- printf("unveil lacks UNVEIL_READ\n");
-#endif
+ DPRINTF("unveil lacks UNVEIL_READ\n");
return 0;
}
}
if (ni->ni_unveil & UNVEIL_WRITE) {
if ((flags & UNVEIL_WRITE) == 0) {
-#ifdef DEBUG_UNVEIL
- printf("unveil lacks UNVEIL_WRITE\n");
-#endif
+ DPRINTF("unveil lacks UNVEIL_WRITE\n");
return 0;
}
}
if (ni->ni_unveil & UNVEIL_EXEC) {
if ((flags & UNVEIL_EXEC) == 0) {
-#ifdef DEBUG_UNVEIL
- printf("unveil lacks UNVEIL_EXEC\n");
-#endif
+ DPRINTF("unveil lacks UNVEIL_EXEC\n");
return 0;
}
}
if (ni->ni_unveil & UNVEIL_CREATE) {
if ((flags & UNVEIL_CREATE) == 0) {
-#ifdef DEBUG_UNVEIL
- printf("unveil lacks UNVEIL_CREATE\n");
-#endif
+ DPRINTF("unveil lacks UNVEIL_CREATE\n");
return 0;
}
}
@@ -639,10 +617,9 @@ unveil_start_relative(struct proc *p, struct nameidata
* Store this match for later use. Flags are checked at the end.
*/
if (uv) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): relative unveil at %p matches",
+ DPRINTF("unveil: %s(%d): relative unveil at %p matches",
pr->ps_comm, pr->ps_pid, uv);
-#endif
+
ni->ni_unveil_match = uv;
}
}
@@ -676,10 +653,9 @@ unveil_check_component(struct proc *p, struct nameidat
if (uv != NULL) {
/* update match */
ni->ni_unveil_match = uv;
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): component directory match for "
+
+ DPRINTF("unveil: %s(%d): component directory match for "
"vnode %p\n", pr->ps_comm, pr->ps_pid, dp);
-#endif
}
}
@@ -698,10 +674,9 @@ unveil_check_final(struct proc *p, struct nameidata *n
return (0);
if (ni->ni_cnd.cn_flags & BYPASSUNVEIL) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): BYPASSUNVEIL.\n",
+ DPRINTF("unveil: %s(%d): BYPASSUNVEIL.\n",
pr->ps_comm, pr->ps_pid);
-#endif
+
return (0);
}
@@ -709,20 +684,18 @@ unveil_check_final(struct proc *p, struct nameidata *n
/* We are matching a directory terminal component */
uv = unveil_lookup(ni->ni_vp, pr, NULL);
if (uv == NULL || (uv->uv_flags & UNVEIL_USERSET) == 0) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) no match for vnode %p\n",
+ DPRINTF("unveil: %s(%d) no match for vnode %p\n",
pr->ps_comm, pr->ps_pid, ni->ni_vp);
-#endif
+
if (uv != NULL)
ni->ni_unveil_match = uv;
goto done;
}
if (!unveil_flagmatch(ni, uv->uv_flags)) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) flag mismatch for directory"
+ DPRINTF("unveil: %s(%d) flag mismatch for directory"
" vnode %p\n",
pr->ps_comm, pr->ps_pid, ni->ni_vp);
-#endif
+
pr->ps_acflag |= AUNVEIL;
if (uv->uv_flags & UNVEIL_MASK)
return EACCES;
@@ -731,39 +704,35 @@ unveil_check_final(struct proc *p, struct nameidata *n
}
/* directory and flags match, success */
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): matched directory \"%s\" at vnode %p\n",
+ DPRINTF("unveil: %s(%d): matched directory \"%s\" at vnode
%p\n",
pr->ps_comm, pr->ps_pid, ni->ni_cnd.cn_nameptr,
uv->uv_vp);
-#endif
+
return (0);
}
/* Otherwise, we are matching a non-terminal component */
uv = unveil_lookup(ni->ni_dvp, pr, NULL);
if (uv == NULL) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) no match for directory vnode %p\n",
+ DPRINTF("unveil: %s(%d) no match for directory vnode %p\n",
pr->ps_comm, pr->ps_pid, ni->ni_dvp);
-#endif
+
goto done;
}
if ((tname = unveil_namelookup(uv, ni->ni_cnd.cn_nameptr)) == NULL) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) no match for terminal '%s' in "
+ DPRINTF("unveil: %s(%d) no match for terminal '%s' in "
"directory vnode %p\n",
pr->ps_comm, pr->ps_pid,
ni->ni_cnd.cn_nameptr, ni->ni_dvp);
-#endif
+
/* no specific name, so check unveil directory flags */
if (!unveil_flagmatch(ni, uv->uv_flags)) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) terminal "
+ DPRINTF("unveil: %s(%d) terminal "
"'%s' flags mismatch in directory "
"vnode %p\n",
pr->ps_comm, pr->ps_pid,
ni->ni_cnd.cn_nameptr, ni->ni_dvp);
-#endif
+
/*
* If dir has user set restrictions fail with
* EACCES or ENOENT. Otherwise, use any covering
@@ -781,27 +750,24 @@ unveil_check_final(struct proc *p, struct nameidata *n
goto done;
}
/* directory flags match, success */
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): matched \"%s\" underneath vnode %p\n",
+ DPRINTF("unveil: %s(%d): matched \"%s\" underneath vnode %p\n",
pr->ps_comm, pr->ps_pid, ni->ni_cnd.cn_nameptr,
uv->uv_vp);
-#endif
+
return (0);
}
if (!unveil_flagmatch(ni, tname->un_flags)) {
/* do flags match for matched name */
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) flag mismatch for terminal '%s'\n",
+ DPRINTF("unveil: %s(%d) flag mismatch for terminal '%s'\n",
pr->ps_comm, pr->ps_pid, tname->un_name);
-#endif
+
pr->ps_acflag |= AUNVEIL;
return EACCES;
}
/* name and flags match. success */
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) matched terminal '%s'\n",
+ DPRINTF("unveil: %s(%d) matched terminal '%s'\n",
pr->ps_comm, pr->ps_pid, tname->un_name);
-#endif
+
return (0);
done:
@@ -811,29 +777,27 @@ done:
*/
for (uv = ni->ni_unveil_match; uv != NULL; uv = nuv) {
if (unveil_flagmatch(ni, uv->uv_flags)) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d): matched \"%s\" underneath/at "
+ DPRINTF("unveil: %s(%d): matched \"%s\" underneath/at "
"vnode %p\n", pr->ps_comm, pr->ps_pid,
ni->ni_cnd.cn_nameptr, uv->uv_vp);
-#endif
+
return (0);
}
/* if node has any flags set then this is an access violation */
if (uv->uv_flags & UNVEIL_USERSET) {
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) flag mismatch for vnode %p\n",
+ DPRINTF("unveil: %s(%d) flag mismatch for vnode %p\n",
pr->ps_comm, pr->ps_pid, uv->uv_vp);
-#endif
+
pr->ps_acflag |= AUNVEIL;
if (uv->uv_flags & UNVEIL_MASK)
return EACCES;
else
return ENOENT;
}
-#ifdef DEBUG_UNVEIL
- printf("unveil: %s(%d) check cover for vnode %p, uv_cover
%zd\n",
+
+ DPRINTF("unveil: %s(%d) check cover for vnode %p, uv_cover
%zd\n",
pr->ps_comm, pr->ps_pid, uv->uv_vp, uv->uv_cover);
-#endif
+
nuv = unveil_covered(uv, uv->uv_vp, p);
if (nuv == uv)
break;
@@ -857,10 +821,9 @@ unveil_removevnode(struct vnode *vp)
if (vp->v_uvcount == 0)
return;
-#ifdef DEBUG_UNVEIL
- printf("unveil_removevnode found vnode %p with count %d\n",
- vp, vp->v_uvcount);
-#endif
+ DPRINTF("%s: found vnode %p with count %d\n",
+ __func__, vp, vp->v_uvcount);
+
vref(vp); /* make sure it is held till we are done */
LIST_FOREACH(pr, &allprocess, ps_list) {
@@ -870,10 +833,10 @@ unveil_removevnode(struct vnode *vp)
uv->uv_vp != NULL) {
uv->uv_vp = NULL;
uv->uv_flags = 0;
-#ifdef DEBUG_UNVEIL
- printf("unveil_removevnode vnode %p now count %d\n",
- vp, vp->v_uvcount);
-#endif
+
+ DPRINTF("%s: vnode %p now count %d\n",
+ __func__, vp, vp->v_uvcount);
+
if (vp->v_uvcount > 0) {
vrele(vp);
vp->v_uvcount--;
