Re: systrace and make again

[Alf Schlichting <leopold-bloom@foni.net>]

And, yes, this is a snapshot from Feb. 01, i386. Damn;)

Am Donnerstag, 6. Februar 2003 00:51 schrieb Alf Schlichting:
> Hi,
> i have another issue with systrace when trying to build the mysql-port.
>
> $ systrace -tUi make
> ....
> ===>  Configuring for mysql-client-3.23.54
> checking build system type... i386-unknown-openbsd3.2
> checking host system type... i386-unknown-openbsd3.2
> checking target system type... i386-unknown-openbsd3.2
> checking for a BSD compatible install... /usr/bin/install -c -o root -g bin
> ......
> checking for unistd.h... (cached) yes
> checking for restartable system calls... /usr/bin/make, pid:
> 30063(0)[21206], policy: /usr/bin/make, filters: 72, syscall:
> native-poll(252), args: 12 Answer: Syntax error.
> Answer: Syntax error.
> Answer: Syntax error.
> Answer: Syntax error.
> Answer: Syntax error.
> Answer: Syntax error.
> ....
>
> This goes on forever in a loop.
>
> This does not happen when using X ( no -t flag), then this question
> gets ask 4 times ( corespondending to setting "continue" to "break"
> in the snipplet below).
> It seems that calling filter_ask(bla... , NULL, bla...) in filter.c
> from systrace.c in gen_cb() line 300 is causing this behaviour;
>
> 	while(1)
> ....
> 		if (fls == NULL) {
> 			printf("Syntax error.\n");
> 			 continue;
> 		}
>
> .....
>
> running sytrace -a make gave me:
> $ grep native-poll /var/log/messages | wc -l
> 24360
> $ tail -n 1 /var/log/messages
> Feb  6 00:03:36 lap systrace: deny user: leopold-bloom, prog:
> /usr/bin/make, pid: 14220(0)[32120], policy: /usr/bin/make, filters: 72,
> syscall: native-poll(252), args: 12
> $
>
> Regards,
> Alf
>
> $ cat /etc/systrace/usr_bin_make
> Policy: /usr/bin/make, Emulation: native
> 	native-break: permit
> 	native-fsread: permit
> 	native-fstat: permit
> 	native-getdirentries: permit
> 	native-mprotect: permit
> 	native-read: permit
> 	native-close: permit
> 	native-pipe: permit
> 	native-fork: permit
> 	native-dup2: permit
> 	native-wait4: permit
> 	native-execve: permit
> 	native-__sysctl: permit
> 	native-issetugid: permit
> 	native-mmap: permit
> 	native-sigaction: permit
> 	native-getpid: permit
> 	native-getppid: permit
> 	native-gettimeofday: permit
> 	native-geteuid: permit
> 	native-getuid: permit
> 	native-getgid: permit
> 	native-getegid: permit
> 	native-sigprocmask: permit
> 	native-fcntl: permit
> 	native-chdir: permit
> 	native-write: permit
> 	native-munmap: permit
> 	native-exit: permit
> 	native-fstatfs: permit
> 	native-lseek: permit
> 	native-sigsuspend: permit
> 	native-getrusage: permit
> 	native-sigreturn: permit
> 	native-umask: permit
> 	native-ioctl: permit
> 	native-getpgrp: permit
> 	native-getlogin: permit
> 	native-pread: permit
> #	native-connect: permit
> 	native-setsockopt: permit
> 	native-setitimer: permit
> 	native-utimes: permit
> 	native-sendto: permit
> 	native-select: permit
> 	native-recvfrom: permit
> 	native-getsockname: permit
> 	native-getrlimit: permit
> 	native-setrlimit: permit
> 	native-fswrite: permit
> 	native-link: permit
> 	native-chmod: permit
> 	native-vfork: permit
> 	native-fchdir: permit
> 	native-kill: permit
> 	native-dup: permit
> 	native-ftruncate: permit
> 	native-rename: permit
> 	native-symlink: permit
> 	native-nanosleep: permit
> 	native-getgroups: permit
> 	native-flock: permit
> 	native-fchflags: permit
> 	native-fchown: permit
> 	native-fchmod: permit
> 	native-chown: permit
> 	native-seteuid: permit
> 	native-setegid: permit
> 	native-setuid: permit
> 	native-setgid: permit
> 	native-setpgid: permit
> 	native-socket: permit
> 	native-connect: sockaddr match "inet-*:53" then permit
> $