Bug 217957 - diff: Cannot create unified diffs when running under kern.trap_enotcap=1
Summary: diff: Cannot create unified diffs when running under kern.trap_enotcap=1
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: FreeBSD bugs mailing list
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2017-03-20 16:19 UTC by Tobias Kortkamp
Modified: 2017-03-20 19:25 UTC (History)
2 users (show)

See Also:


Attachments
diff.diff (408 bytes, patch)
2017-03-20 16:19 UTC, Tobias Kortkamp
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Tobias Kortkamp freebsd_committer 2017-03-20 16:19:29 UTC
Created attachment 181005 [details]
diff.diff

This happens while running 'diff -u file1 file2' (file1 and file2 need
to actually differ).

After cap_enter() and after reading file1, diff(1) will try to open
the following files which isn't allowed in capability mode:

access("/etc/localtime",R_OK)			 ERR#94 'Not permitted in capability mode'
issetugid()					 = 0 (0x0)
open("/usr/share/zoneinfo/UTC",O_RDONLY,00)	 ERR#94 'Not permitted in capability mode'
issetugid()					 = 0 (0x0)
open("/usr/share/zoneinfo/posixrules",O_RDONLY,06423226000) ERR#94 'Not permitted in capability mode'

Unfortunately when kern.trap_enotcap=1 is accidentally still set, it
means diff will die immediately after access().

To workaround this we could initialize time conversion information with tzset(3)
just before cap_enter().
Comment 1 commit-hook freebsd_committer 2017-03-20 19:24:23 UTC
A commit references this bug:

Author: bapt
Date: Mon Mar 20 19:24:16 UTC 2017
New revision: 315649
URL: https://svnweb.freebsd.org/changeset/base/315649

Log:
  Cache tzdata when running under capsicum

  PR:		217957
  Reported by:	tobik@

Changes:
  head/usr.bin/diff/diffreg.c
Comment 2 Baptiste Daroussin freebsd_committer 2017-03-20 19:25:45 UTC
I fixed with another diff caph_cache_tzdata which is designed for that

Thank you