Hacker News Reader

Comment by philsnow | Hacker News Reader

I can't see where in this patch forked children inherit the `ps_tame` from the parent process. I don't know this kernel at all but it seems like something like this should be in sys/kern/kern_fork.c

    pr->ps_tame = parent->ps_tame

Otherwise tamed processes could just fork a process to do things they've declared that they won't do.

View on HN

A tamed process cannot even call fork(2) unless the TAME_PROC flag is passed, in which case I'd assume the child process would then inherit a copy from the parent as part of a normal fork(2) operation. It can be later revoked by the child, but it may want to keep it for kill(2).

I'm `cvs get`ting as fast as I can to read the rest of sys_fork.c to sate my curiosity, but CVS incredibly slow. I'm spoiled by how git packs the repo.

turned out to be way faster just to grab http://mirrors.sonic.net/pub/OpenBSD/5.7/sys.tar.gz , if anybody else wants to poke around and doesn't want to wait for cvs.

You can also view the source on the cvs web mirror: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/

Sounds like you're doing something unnecessarily more complicated than this:

$ time cvs -d anoncvs@anoncvs1.ca.openbsd.org:/cvs export -rHEAD src/sys/kern/kern_fork.c

U src/sys/kern/kern_fork.c

    0m2.73s real     0m0.06s user     0m0.04s system

Yep, I was grabbing `src` instead of `src/sys/kern/kern_fork.c`. I've completely forgotten how to CVS, and I'm okay with that.

Perhaps you'll like this, then: https://github.com/ustuehler/git-cvs

What are the reasons why CVS is still in use?

  1. it works
  2. they're used to it
  3. there isn't enough reason to change
  4. lots of infrastructure would need rebuilt if they changed

Because we're already too busy with porting our code base to Ruby.

I wonder if this is related to the "capsicum needs you to rewrite programs" bit. I.e. the capsicum man page explicitly says

> Once set, the flag is inherited by future children processes, and may not be cleared.

And mentions that specific new APIs should be used in order to manage processes through capabilities.

Note that about half of the parent proc struct is simply copied into the child.

Ah yeah, just found that, the patch has a couple lines added to sys/proc.h,

    +	u_int	ps_tame;
    +

, right before the end of what's defined as `ps_endcopy`, which is copied from parent to child in `process_initialize`.

Makes sense now.

Reply on news.ycombinator.com