Subject: Re: kern.showallprocs implementation
To: matthew green <mrg@eterna.com.au>
From: Andrew Brown <atatat@atatdot.net>
List: tech-security
Date: 06/26/2004 13:07:27
On Sat, Jun 26, 2004 at 12:04:05PM +1000, matthew green wrote:
>
>i like this idea.
>
>   
>   1049a1058,1080
>   >  * sysctl helper function for kern.showallprocs. allowed values are 0 and 1.
>   >  */
>   > static int
>   > sysctl_kern_showallprocs(SYSCTLFN_ARGS)
>   > {
>   > 	int error, nshowallprocs;
>   > 	struct sysctlnode node;
>   > 	
>   > 	nshowallprocs = showallprocs;
>   > 	node = *rnode;
>   >         node.sysctl_data = &nshowallprocs;
>   > 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
>   > 	if (error || newp == NULL)
>   > 		return (error);
>   >         if (nshowallprocs < 0 || nshowallprocs > 1)
>   > 		return (EINVAL);
>   > 
>   > 	showallprocs = nshowallprocs;
>   > 
>   > 	return (0);
>   > }
>
>is this necessary?  can't we just define it as being 0 or non-zero
>and not have to have the extra code of this function? 

zero vs non-zero makes sense.

>(it seems there are a lot of these "tiny" functions to check sysctl..
>i wonder if a generic method for min/max bounds checking could be
>implemented in the sysctl framework itself?  it seems there'd be
>dozens or even hundreds of functions that could be removed ...)

there are, at this point, around five (or is it six) functions that
are solely doing range checking.  everything performs at least one
other function.

when i was redoing sysctl, it really seemed to me that the added
impact in memory consumption (16 bytes per node, at least, adding up
to probably around 10k of kvm on my laptop) and code complexity to
implement range checking in the infrastructure far outweighed the
"inconvenience" of having a few helpers whose sole purpose is range
checking.

so...there's no place in sysctl_createv() to set ranges because range
checking isn't done by the infrastructure.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
werdna@squooshy.com       * "information is power -- share the wealth."