ktrace/kdump give incorrect message on unlinkat() failure due to capabilities

[Sergey Kandaurov]

On Mon, Oct 07, 2019 at 09:48:16AM -0700, John Baldwin wrote:
> On 9/25/19 10:33 AM, Sergey Kandaurov wrote:
> > 
> > Index: lib/libsysdecode/mktables
> > ===================================================================
> > --- lib/libsysdecode/mktables	(revision 352685)
> > +++ lib/libsysdecode/mktables	(working copy)
> > @@ -157,7 +157,7 @@
> >  gen_table "sigcode"         "SI_[A-Z]+[[:space:]]+0(x[0-9abcdef]+)?"       "sys/signal.h"
> >  gen_table "umtxcvwaitflags" "CVWAIT_[A-Z_]+[[:space:]]+0x[0-9]+"           "sys/umtx.h"
> >  gen_table "umtxrwlockflags" "URWLOCK_PREFER_READER[[:space:]]+0x[0-9]+"    "sys/umtx.h"
> > -gen_table "caprights"       "CAP_[A-Z_]+[[:space:]]+CAPRIGHT\([0-9],[[:space:]]+0x[0-9]{16}ULL\)"   "sys/capsicum.h"
> > +gen_table "caprights"       "CAP_[A-Z_]+[[:space:]]+(CAPRIGHT|[()A-Z_|[:space:]]+CAP_LOOKUP)"   "sys/capsicum.h"
> >  gen_table "sctpprpolicy"    "SCTP_PR_SCTP_[A-Z_]+[[:space:]]+0x[0-9]+"     "netinet/sctp_uio.h" "SCTP_PR_SCTP_ALL"
> >  gen_table "cmsgtypesocket"  "SCM_[A-Z_]+[[:space:]]+0x[0-9]+"              "sys/socket.h"
> >  if [ -e "${include_dir}/x86/sysarch.h" ]; then
> 
> CAP_SEEK and CAP_MMAP_X might also be subject to this.  However, I'm not quite
> understanding the regex, or at least why the modified portion of the regex isn't
> something like this:
> 
> (CAPRIGHT\(|\(CAP_LOOKUP)

This won't match against CAP_LOOKUP on the right side, as in CAP_FSTATAT,
but since it is built from CAP_FSTAT and CAP_LOOKUP, it should be fine still.

> That is, you currently have [()A-Z_|[:space:]]+ for an expression that I think
> will only ever match a single '(' character.

All this sad magic is for preceding characters before CAP_LOOKUP,
such as in "(CAP_FSTAT | CAP_LOOKUP".  But seems it isn't needed.

> A more general form that might work for CAP_SEEK and CAP_MMAP_X might be
> to match on 'CAP_<foo> | 0x<constant)', so something like:
> 
> (CAPRIGHT\(|\([^)]*CAP_[A-Z_]+ \| 0x[0-9]+)

Given the above, it looks fine.