svn commit: r197881 - in projects/capabilities8:
contrib/openbsm/libbsm contrib/openbsm/sys/bsm
contrib/tcpdump crypto/openssh gnu/usr.bin/groff/tmac lib
lib/libc/gen lib/libc/sys lib/libcapability...
Robert Watson
rwatson at FreeBSD.org
Thu Oct 8 22:21:54 UTC 2009
Author: rwatson
Date: Thu Oct 8 22:21:53 2009
New Revision: 197881
URL: http://svn.freebsd.org/changeset/base/197881
Log:
Merge TrustedBSD capabilities prototype snapshot from Perforce to
capabilities8 project branch; primary development will continue in
Perforce, but this branch will allow 8.x users to work with the
capabilities parts without braving 9.x.
Obtained from: TrustedBSD Project
Sponsored by: Google
Added:
projects/capabilities8/lib/libc/gen/ld_caplibindex.c (contents, props changed)
projects/capabilities8/lib/libc/gen/ld_sandbox.c (contents, props changed)
projects/capabilities8/lib/libc/sys/cap_enter.2 (contents, props changed)
projects/capabilities8/lib/libc/sys/cap_new.2 (contents, props changed)
projects/capabilities8/lib/libc/sys/pdfork.2 (contents, props changed)
projects/capabilities8/lib/libcapability/
projects/capabilities8/lib/libcapability/Makefile (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability.3 (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability.c (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability.h (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability_host.3 (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability_host.c (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability_host_io.c (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability_internal.h (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability_sandbox.3 (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability_sandbox.c (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability_sandbox_api.h (contents, props changed)
projects/capabilities8/lib/libcapability/libcapability_sandbox_io.c (contents, props changed)
projects/capabilities8/libexec/rtld-elf-cap/
projects/capabilities8/libexec/rtld-elf-cap/Makefile (contents, props changed)
projects/capabilities8/libexec/rtld-elf-cap/Symbol.map
projects/capabilities8/libexec/rtld-elf-cap/rtld-elf-cap.1 (contents, props changed)
projects/capabilities8/libexec/rtld-elf-cap/rtld-elf-cap.xs
projects/capabilities8/libexec/rtld-elf-cap/rtld_caplibindex.c (contents, props changed)
projects/capabilities8/libexec/rtld-elf-cap/rtld_caplibindex.h (contents, props changed)
projects/capabilities8/libexec/rtld-elf-cap/rtld_sandbox.c (contents, props changed)
projects/capabilities8/libexec/rtld-elf-cap/rtld_sandbox.h (contents, props changed)
projects/capabilities8/sys/kern/capabilities.conf (contents, props changed)
projects/capabilities8/sys/kern/sys_capability.c (contents, props changed)
projects/capabilities8/sys/kern/sys_procdesc.c (contents, props changed)
projects/capabilities8/sys/sys/capability.h (contents, props changed)
projects/capabilities8/sys/sys/procdesc.h (contents, props changed)
projects/capabilities8/usr.bin/gzip/gzsandbox.c (contents, props changed)
Modified:
projects/capabilities8/contrib/openbsm/libbsm/bsm_errno.c
projects/capabilities8/contrib/openbsm/sys/bsm/audit_errno.h
projects/capabilities8/contrib/tcpdump/tcpdump.c
projects/capabilities8/crypto/openssh/sshd.c
projects/capabilities8/gnu/usr.bin/groff/tmac/mdoc.local
projects/capabilities8/lib/Makefile
projects/capabilities8/lib/libc/gen/Makefile.inc
projects/capabilities8/lib/libc/gen/Symbol.map
projects/capabilities8/lib/libc/gen/errlst.c
projects/capabilities8/lib/libc/sys/Makefile.inc
projects/capabilities8/lib/libc/sys/Symbol.map
projects/capabilities8/lib/libc/sys/fork.2
projects/capabilities8/lib/libc/sys/intro.2
projects/capabilities8/lib/libkvm/kvm_proc.c
projects/capabilities8/libexec/Makefile
projects/capabilities8/libexec/rtld-elf/Makefile
projects/capabilities8/libexec/rtld-elf/map_object.c
projects/capabilities8/libexec/rtld-elf/rtld.c
projects/capabilities8/sbin/dhclient/dhclient.c
projects/capabilities8/share/mk/bsd.libnames.mk
projects/capabilities8/sys/amd64/amd64/sys_machdep.c
projects/capabilities8/sys/amd64/linux32/linux32_machdep.c
projects/capabilities8/sys/amd64/linux32/linux32_proto.h
projects/capabilities8/sys/amd64/linux32/linux32_syscall.h
projects/capabilities8/sys/amd64/linux32/linux32_sysent.c
projects/capabilities8/sys/arm/arm/sys_machdep.c
projects/capabilities8/sys/bsm/audit_errno.h
projects/capabilities8/sys/cddl/compat/opensolaris/sys/file.h
projects/capabilities8/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c
projects/capabilities8/sys/compat/freebsd32/freebsd32_proto.h
projects/capabilities8/sys/compat/freebsd32/freebsd32_syscall.h
projects/capabilities8/sys/compat/freebsd32/freebsd32_syscalls.c
projects/capabilities8/sys/compat/freebsd32/freebsd32_sysent.c
projects/capabilities8/sys/compat/freebsd32/syscalls.master
projects/capabilities8/sys/compat/linux/linux_file.c
projects/capabilities8/sys/compat/linux/linux_ioctl.c
projects/capabilities8/sys/compat/linux/linux_socket.c
projects/capabilities8/sys/compat/linux/linux_stats.c
projects/capabilities8/sys/compat/svr4/svr4_fcntl.c
projects/capabilities8/sys/compat/svr4/svr4_filio.c
projects/capabilities8/sys/compat/svr4/svr4_ioctl.c
projects/capabilities8/sys/compat/svr4/svr4_proto.h
projects/capabilities8/sys/compat/svr4/svr4_stream.c
projects/capabilities8/sys/compat/svr4/svr4_syscall.h
projects/capabilities8/sys/compat/svr4/svr4_syscallnames.c
projects/capabilities8/sys/compat/svr4/svr4_sysent.c
projects/capabilities8/sys/conf/NOTES
projects/capabilities8/sys/conf/files
projects/capabilities8/sys/conf/options
projects/capabilities8/sys/dev/aac/aac_linux.c
projects/capabilities8/sys/dev/amr/amr_linux.c
projects/capabilities8/sys/dev/hwpmc/hwpmc_logging.c
projects/capabilities8/sys/dev/ipmi/ipmi_linux.c
projects/capabilities8/sys/dev/iscsi/initiator/iscsi.c
projects/capabilities8/sys/dev/mfi/mfi_linux.c
projects/capabilities8/sys/dev/snp/snp.c
projects/capabilities8/sys/dev/tdfx/tdfx_linux.c
projects/capabilities8/sys/fs/fdescfs/fdesc_vnops.c
projects/capabilities8/sys/fs/nfs/nfsport.h
projects/capabilities8/sys/fs/nfsclient/nfs_clport.c
projects/capabilities8/sys/fs/nfsserver/nfs_nfsdport.c
projects/capabilities8/sys/fs/portalfs/portal_vfsops.c
projects/capabilities8/sys/fs/portalfs/portal_vnops.c
projects/capabilities8/sys/gnu/fs/xfs/xfs_dfrag.c
projects/capabilities8/sys/i386/i386/sys_machdep.c
projects/capabilities8/sys/i386/i386/trap.c
projects/capabilities8/sys/i386/ibcs2/ibcs2_fcntl.c
projects/capabilities8/sys/i386/ibcs2/ibcs2_ioctl.c
projects/capabilities8/sys/i386/ibcs2/ibcs2_proto.h
projects/capabilities8/sys/i386/ibcs2/ibcs2_syscall.h
projects/capabilities8/sys/i386/ibcs2/ibcs2_sysent.c
projects/capabilities8/sys/i386/linux/linux_machdep.c
projects/capabilities8/sys/i386/linux/linux_proto.h
projects/capabilities8/sys/i386/linux/linux_syscall.h
projects/capabilities8/sys/i386/linux/linux_sysent.c
projects/capabilities8/sys/kern/Makefile
projects/capabilities8/sys/kern/imgact_elf.c
projects/capabilities8/sys/kern/init_sysent.c
projects/capabilities8/sys/kern/kern_descrip.c
projects/capabilities8/sys/kern/kern_event.c
projects/capabilities8/sys/kern/kern_exec.c
projects/capabilities8/sys/kern/kern_exit.c
projects/capabilities8/sys/kern/kern_fork.c
projects/capabilities8/sys/kern/kern_mib.c
projects/capabilities8/sys/kern/kern_sig.c
projects/capabilities8/sys/kern/kern_sysctl.c
projects/capabilities8/sys/kern/makesyscalls.sh
projects/capabilities8/sys/kern/posix4_mib.c
projects/capabilities8/sys/kern/subr_smp.c
projects/capabilities8/sys/kern/sys_generic.c
projects/capabilities8/sys/kern/syscalls.c
projects/capabilities8/sys/kern/syscalls.master
projects/capabilities8/sys/kern/systrace_args.c
projects/capabilities8/sys/kern/tty.c
projects/capabilities8/sys/kern/uipc_mqueue.c
projects/capabilities8/sys/kern/uipc_sem.c
projects/capabilities8/sys/kern/uipc_shm.c
projects/capabilities8/sys/kern/uipc_syscalls.c
projects/capabilities8/sys/kern/uipc_usrreq.c
projects/capabilities8/sys/kern/vfs_acl.c
projects/capabilities8/sys/kern/vfs_aio.c
projects/capabilities8/sys/kern/vfs_extattr.c
projects/capabilities8/sys/kern/vfs_lookup.c
projects/capabilities8/sys/kern/vfs_syscalls.c
projects/capabilities8/sys/netgraph/ng_socket.c
projects/capabilities8/sys/nfsserver/nfs_srvkrpc.c
projects/capabilities8/sys/security/audit/audit.h
projects/capabilities8/sys/security/audit/audit_arg.c
projects/capabilities8/sys/security/audit/audit_bsm.c
projects/capabilities8/sys/security/audit/audit_bsm_errno.c
projects/capabilities8/sys/security/audit/audit_private.h
projects/capabilities8/sys/security/mac/mac_syscalls.c
projects/capabilities8/sys/sparc64/sparc64/sys_machdep.c
projects/capabilities8/sys/sys/_types.h
projects/capabilities8/sys/sys/errno.h
projects/capabilities8/sys/sys/file.h
projects/capabilities8/sys/sys/filedesc.h
projects/capabilities8/sys/sys/proc.h
projects/capabilities8/sys/sys/syscall.h
projects/capabilities8/sys/sys/syscall.mk
projects/capabilities8/sys/sys/sysctl.h
projects/capabilities8/sys/sys/sysent.h
projects/capabilities8/sys/sys/sysproto.h
projects/capabilities8/sys/sys/types.h
projects/capabilities8/sys/sys/ucred.h
projects/capabilities8/sys/sys/unistd.h
projects/capabilities8/sys/sys/user.h
projects/capabilities8/sys/ufs/ffs/ffs_alloc.c
projects/capabilities8/sys/vm/vm_mmap.c
projects/capabilities8/usr.bin/gzip/Makefile
projects/capabilities8/usr.bin/gzip/gzip.c
projects/capabilities8/usr.bin/gzip/unbzip2.c
projects/capabilities8/usr.bin/procstat/procstat.1
projects/capabilities8/usr.bin/procstat/procstat.c
projects/capabilities8/usr.bin/procstat/procstat.h
projects/capabilities8/usr.bin/procstat/procstat_cred.c
projects/capabilities8/usr.bin/procstat/procstat_files.c
Modified: projects/capabilities8/contrib/openbsm/libbsm/bsm_errno.c
==============================================================================
--- projects/capabilities8/contrib/openbsm/libbsm/bsm_errno.c Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/contrib/openbsm/libbsm/bsm_errno.c Thu Oct 8 22:21:53 2009 (r197881)
@@ -684,6 +684,13 @@ static const struct bsm_errno bsm_errnos
ERRNO_NO_LOCAL_MAPPING,
#endif
ES("Key was rejected by service") },
+ { BSM_ERRNO_ENOTCAPABLE,
+#ifdef ENOTCAPABLE
+ ENOTCAPABLE,
+#else
+ ERRNO_NO_LOCAL_MAPPING,
+#endif
+ ES("Capabilities insufficient") },
};
static const int bsm_errnos_count = sizeof(bsm_errnos) / sizeof(bsm_errnos[0]);
Modified: projects/capabilities8/contrib/openbsm/sys/bsm/audit_errno.h
==============================================================================
--- projects/capabilities8/contrib/openbsm/sys/bsm/audit_errno.h Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/contrib/openbsm/sys/bsm/audit_errno.h Thu Oct 8 22:21:53 2009 (r197881)
@@ -204,6 +204,7 @@
#define BSM_ERRNO_EKEYEXPIRED 220 /* Linux-specific. */
#define BSM_ERRNO_EKEYREVOKED 221 /* Linux-specific. */
#define BSM_ERRNO_EKEYREJECTED 222 /* Linux-specific. */
+#define BSM_ERRNO_ENOTCAPABLE 223 /* FreeBSD-specific. */
/*
* In the event that OpenBSM doesn't have a file representation of a local
Modified: projects/capabilities8/contrib/tcpdump/tcpdump.c
==============================================================================
--- projects/capabilities8/contrib/tcpdump/tcpdump.c Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/contrib/tcpdump/tcpdump.c Thu Oct 8 22:21:53 2009 (r197881)
@@ -1197,6 +1197,8 @@ main(int argc, char **argv)
(void)fflush(stderr);
}
#endif /* WIN32 */
+ if (cap_enter() < 0)
+ err(-1, "cap_enter");
status = pcap_loop(pd, cnt, callback, pcap_userdata);
if (WFileName == NULL) {
/*
Modified: projects/capabilities8/crypto/openssh/sshd.c
==============================================================================
--- projects/capabilities8/crypto/openssh/sshd.c Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/crypto/openssh/sshd.c Thu Oct 8 22:21:53 2009 (r197881)
@@ -46,6 +46,7 @@
__RCSID("$FreeBSD$");
#include <sys/types.h>
+#include <sys/capability.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#ifdef HAVE_SYS_STAT_H
@@ -620,6 +621,8 @@ privsep_preauth_child(void)
fatal("setgroups: %.100s", strerror(errno));
permanently_set_uid(privsep_pw);
#endif
+ if (cap_enter() != 0 && errno != ENOSYS)
+ fatal("cap_enter: %.100s", strerror(errno));
}
static int
Modified: projects/capabilities8/gnu/usr.bin/groff/tmac/mdoc.local
==============================================================================
--- projects/capabilities8/gnu/usr.bin/groff/tmac/mdoc.local Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/gnu/usr.bin/groff/tmac/mdoc.local Thu Oct 8 22:21:53 2009 (r197881)
@@ -38,6 +38,7 @@
.ds doc-str-Lb-libc_r Reentrant C\~Library (libc_r, \-lc_r)
.ds doc-str-Lb-libcalendar Calendar Arithmetic Library (libcalendar, \-lcalendar)
.ds doc-str-Lb-libcam Common Access Method User Library (libcam, \-lcam)
+.ds doc-str-Lb-libcapability Capability Services Library (libcapability, \-lcapability)
.ds doc-str-Lb-libcipher FreeSec Crypt Library (libcipher, \-lcipher)
.ds doc-str-Lb-libdevinfo Device and Resource Information Utility Library (libdevinfo, \-ldevinfo)
.ds doc-str-Lb-libdevstat Device Statistics Library (libdevstat, \-ldevstat)
Modified: projects/capabilities8/lib/Makefile
==============================================================================
--- projects/capabilities8/lib/Makefile Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/lib/Makefile Thu Oct 8 22:21:53 2009 (r197881)
@@ -32,7 +32,9 @@ SUBDIR= ${_csu} libc libbsm libauditd li
ncurses ${_libnetgraph} libradius librpcsvc libsbuf \
libtacplus libutil ${_libypclnt} libalias libarchive ${_libatm} \
libbegemot ${_libbluetooth} ${_libbsnmp} libbz2 \
- libcalendar libcam libcompat libdevinfo libdevstat libdisk \
+ libcalendar libcam libcapability libcompat \
+ libdevinfo libdevstat \
+ libdisk \
libdwarf libedit libexpat libfetch libftpio libgeom ${_libgpib} \
${_libgssapi} ${_librpcsec_gss} libipsec \
${_libipx} libjail libkiconv libmagic libmemstat ${_libmilter} \
Modified: projects/capabilities8/lib/libc/gen/Makefile.inc
==============================================================================
--- projects/capabilities8/lib/libc/gen/Makefile.inc Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/lib/libc/gen/Makefile.inc Thu Oct 8 22:21:53 2009 (r197881)
@@ -19,6 +19,7 @@ SRCS+= __getosreldate.c __xuname.c \
getpeereid.c getprogname.c getpwent.c getttyent.c \
getusershell.c getvfsbyname.c glob.c \
initgroups.c isatty.c isinf.c isnan.c jrand48.c lcong48.c \
+ ld_caplibindex.c ld_sandbox.c \
lockf.c lrand48.c mrand48.c nftw.c nice.c \
nlist.c nrand48.c opendir.c \
pause.c pmadvise.c popen.c posix_spawn.c pselect.c \
Modified: projects/capabilities8/lib/libc/gen/Symbol.map
==============================================================================
--- projects/capabilities8/lib/libc/gen/Symbol.map Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/lib/libc/gen/Symbol.map Thu Oct 8 22:21:53 2009 (r197881)
@@ -341,6 +341,8 @@ FBSD_1.1 {
fts_read;
fts_set;
fts_set_clientptr;
+ ld_caplibindex_lookup;
+ ld_insandbox;
posix_spawn;
posix_spawn_file_actions_addclose;
posix_spawn_file_actions_adddup2;
Modified: projects/capabilities8/lib/libc/gen/errlst.c
==============================================================================
--- projects/capabilities8/lib/libc/gen/errlst.c Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/lib/libc/gen/errlst.c Thu Oct 8 22:21:53 2009 (r197881)
@@ -150,5 +150,6 @@ const char *const sys_errlist[] = {
"Multihop attempted", /* 90 - EMULTIHOP */
"Link has been severed", /* 91 - ENOLINK */
"Protocol error", /* 92 - EPROTO */
+ "Capabilities insufficient", /* 93 - ENOTCAPABLE */
};
const int sys_nerr = sizeof(sys_errlist) / sizeof(sys_errlist[0]);
Added: projects/capabilities8/lib/libc/gen/ld_caplibindex.c
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ projects/capabilities8/lib/libc/gen/ld_caplibindex.c Thu Oct 8 22:21:53 2009 (r197881)
@@ -0,0 +1,43 @@
+/*-
+ * Copyright (c) 2008-2009 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED
+ * ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND
+ * UNEXPECTED WAYS.
+ *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <errno.h>
+
+#pragma weak ld_caplibindex_lookup
+int
+ld_caplibindex_lookup(const char *libname, int *fdp)
+{
+
+ errno = EOPNOTSUPP;
+ return (-1);
+}
Added: projects/capabilities8/lib/libc/gen/ld_sandbox.c
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ projects/capabilities8/lib/libc/gen/ld_sandbox.c Thu Oct 8 22:21:53 2009 (r197881)
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2008-2009 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED
+ * ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND
+ * UNEXPECTED WAYS.
+ *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma weak ld_insandbox
+int
+ld_insandbox(void)
+{
+
+ return (0);
+}
Modified: projects/capabilities8/lib/libc/sys/Makefile.inc
==============================================================================
--- projects/capabilities8/lib/libc/sys/Makefile.inc Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/lib/libc/sys/Makefile.inc Thu Oct 8 22:21:53 2009 (r197881)
@@ -64,7 +64,7 @@ ${SPSEUDO}:
MAN+= abort2.2 accept.2 access.2 acct.2 adjtime.2 \
aio_cancel.2 aio_error.2 aio_read.2 aio_return.2 \
aio_suspend.2 aio_waitcomplete.2 aio_write.2 \
- bind.2 brk.2 chdir.2 chflags.2 \
+ bind.2 brk.2 cap_enter.2 cap_new.2 chdir.2 chflags.2 \
chmod.2 chown.2 chroot.2 clock_gettime.2 close.2 closefrom.2 \
connect.2 cpuset.2 cpuset_getaffinity.2 dup.2 execve.2 _exit.2 \
extattr_get_file.2 fcntl.2 fhopen.2 flock.2 fork.2 fsync.2 \
@@ -83,7 +83,8 @@ MAN+= abort2.2 accept.2 access.2 acct.2
mq_setattr.2 \
msgctl.2 msgget.2 msgrcv.2 msgsnd.2 \
msync.2 munmap.2 nanosleep.2 nfssvc.2 ntp_adjtime.2 open.2 \
- pathconf.2 pipe.2 poll.2 posix_openpt.2 profil.2 ptrace.2 quotactl.2 \
+ pathconf.2 pdfork.2 \
+ pipe.2 poll.2 posix_openpt.2 profil.2 ptrace.2 quotactl.2 \
read.2 readlink.2 reboot.2 recv.2 rename.2 revoke.2 rfork.2 rmdir.2 \
rtprio.2
.if !defined(NO_P1003_1B)
@@ -104,6 +105,8 @@ MAN+= sctp_generic_recvmsg.2 sctp_generi
MLINKS+=access.2 eaccess.2 access.2 faccessat.2
MLINKS+=brk.2 sbrk.2
+MLINKS+=cap_enter.2 cap_getmode.2
+MLINKS+=cap_new.2 cap_getrights.2
MLINKS+=chdir.2 fchdir.2
MLINKS+=chflags.2 fchflags.2 chflags.2 lchflags.2
MLINKS+=chmod.2 fchmod.2 chmod.2 fchmodat.2 chmod.2 lchmod.2
@@ -161,6 +164,9 @@ MLINKS+=ntp_adjtime.2 ntp_gettime.2
MLINKS+=open.2 openat.2
MLINKS+=pathconf.2 fpathconf.2
MLINKS+=pathconf.2 lpathconf.2
+MLINKS+=pdfork.2 pdgetpid.2 \
+ pdfork.2 pdkill.2 \
+ pdfork.2 pdwait4.2
MLINKS+=read.2 pread.2 read.2 preadv.2 read.2 readv.2
MLINKS+=readlink.2 readlinkat.2
MLINKS+=recv.2 recvfrom.2 recv.2 recvmsg.2
Modified: projects/capabilities8/lib/libc/sys/Symbol.map
==============================================================================
--- projects/capabilities8/lib/libc/sys/Symbol.map Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/lib/libc/sys/Symbol.map Thu Oct 8 22:21:53 2009 (r197881)
@@ -329,6 +329,10 @@ FBSD_1.0 {
FBSD_1.1 {
__semctl;
+ cap_enter;
+ cap_getmode;
+ cap_getrights;
+ cap_new;
closefrom;
cpuset;
cpuset_getid;
@@ -351,6 +355,10 @@ FBSD_1.1 {
mknodat;
msgctl;
openat;
+ pdfork;
+ pdgetpid;
+ pdkill;
+ pdwait4;
readlinkat;
renameat;
setfib;
Added: projects/capabilities8/lib/libc/sys/cap_enter.2
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ projects/capabilities8/lib/libc/sys/cap_enter.2 Thu Oct 8 22:21:53 2009 (r197881)
@@ -0,0 +1,112 @@
+.\"
+.\" Copyright (c) 2008-2009 Robert N. M. Watson
+.\" All rights reserved.
+.\"
+.\" WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED
+.\" ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND
+.\" UNEXPECTED WAYS.
+.\"
+.\" This software was developed at the University of Cambridge Computer
+.\" Laboratory with support from a grant from Google, Inc.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd June 11, 2009
+.Dt CAP_ENTER 2
+.Os
+.Sh NAME
+.Nm cap_enter ,
+.Nm cap_getmode
+.Nd Capability mode system calls
+.Sh LIBRARY
+.Lb libc
+.Sh SYNOPSIS
+.In sys/capability.h
+.Ft int
+.Fn cap_enter "void"
+.Ft int
+.Fn cap_getmode "u_int *modep"
+.Sh DESCRIPTION
+.Fn cap_enter
+places the current process into capability mode, a mode of execution in which
+processes may only issue system calls operating on file descriptors or
+reading limited global system state.
+Access to global name spaces, such as file system or IPC name spaces, is
+prevented.
+If the process is already in a capability mode sandbox, the system call is a
+no-op.
+Future process descendants create with
+.Xr fork 2
+or
+.Xr pdfork 2
+will be placed in capability mode from inception.
+.Pp
+When combined with capabilities created with
+.Xr cap_new 2 ,
+.Fn cap_enter
+may be used to create kernel-enforced sandboxes in which
+appropriately-crafted applications or application components may be run.
+Most sandboxes will be created and managed using the
+.Xr libcapability
+library, rather than using system calls directly.
+.Pp
+.Fn cap_getmode
+returns a flag indicating whether or not the process is in a capability mode
+sandbox.
+.Sh CAVEAT
+Creating effecive process sandboxes is a tricky process that involves
+identifying the least possible rights required by the process and then
+passing those rights into the process in a safe manner.
+See the CAVEAT
+section of
+.Xr cap_new 2
+for why this is particularly tricky with UNIX file descriptors as the
+canonical representation of a right.
+Consumers of
+.Fn cap_enter
+should also be aware of other inheritted rights, such as access to VM
+resources, memory contents, and other process properties that should be
+considered.
+It is advisable to use
+.Xr fexecve 2
+to create a runtime environment inside the sandbox that has as few implicitly
+acquired rights as possible.
+.Sh RETURN VALUES
+.Rv -std cap_enter cap_getmode
+.Sh SEE ALSO
+.Xr cap_new 2 ,
+.Xr fexecve 2 ,
+.Xr libcapability 3
+.Sh HISTORY
+Support for capabilities and capabilities mode was developed as part of the
+.Tn TrustedBSD
+Project.
+.Sh BUGS
+WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED ON IN
+PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND UNEXPECTED WAYS.
+.Sh AUTHORS
+These functions and the capability facility were created by
+.An "Robert N. M. Watson"
+at the University of Cambridge Computer Laboratory with support from a grant
+from Google, Inc.
Added: projects/capabilities8/lib/libc/sys/cap_new.2
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ projects/capabilities8/lib/libc/sys/cap_new.2 Thu Oct 8 22:21:53 2009 (r197881)
@@ -0,0 +1,481 @@
+.\"
+.\" Copyright (c) 2008-2009 Robert N. M. Watson
+.\" All rights reserved.
+.\"
+.\" WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED
+.\" ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND
+.\" UNEXPECTED WAYS.
+.\"
+.\" This software was developed at the University of Cambridge Computer
+.\" Laboratory with support from a grant from Google, Inc.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd June 11, 2009
+.Dt CAP_NEW 2
+.Os
+.Sh NAME
+.Nm cap_new ,
+.Nm cap_getrights
+.Nd System calls to manipulate capabilities
+.Sh LIBRARY
+.Lb libc
+.Sh SYNOPSIS
+.In sys/capability.h
+.Ft int
+.Fn cap_new "int fd" "cap_rights_t rights"
+.Ft int
+.Fn cap_getrights "int fd" "cap_rights_t *rightsp"
+.Sh DESCRIPTION
+Capabilities are special file descriptors derived from an existing file
+descriptor, such as one returned by
+.Xr fhopen 2 ,
+.Xr kqueue 2 ,
+.Xr mq_open 2 ,
+.Xr open 2 ,
+.Xr pipe 2 ,
+.Xr shm_open 2 ,
+.Xr socket 2 ,
+or
+.Xr socketpair 2 ,
+but with a restricted set of permitted operations determined by a rights
+mask set when the capability is created.
+These restricted rights cannot be changed after the capability is created,
+although further capabilities with yet more restricted rights may be created
+from an existing capability.
+In every other sense, a capability behaves in the same way as the file
+descriptor it was created from.
+.Pp
+.Fn cap_new
+creates a new capability for the existing file descriptor
+.Fa fd ,
+and returns a file descriptor for it.
+Operations on the capability will be limited to those permitted by
+.Fa rights ,
+which is static for the lifetime of the capability.
+If
+.Fa fd
+refers to an existing capability, then
+.Fa rights
+must be equal to or a subset of the rights on that capability.
+As with
+.Xr dup 2
+and
+.Xr dup2 2 ,
+many properties are shared between the new capability and the existing file
+descriptor, including open file flags, blocking disposition, and file offset.
+Many applications will prefer to use the
+.Xr cap_limitfd 3
+library call, part of
+.Xr libcapability 3 ,
+as it offers a more convenient interface.
+.Pp
+.Fn cap_getrights
+queries the rights associated with the capability referred to by file
+descriptor
+.Fa fd .
+.Pp
+These system calls, when combined with
+.Xr cap_enter 2 ,
+may be used to construct process sandboxes with highly granular rights
+assignment.
+.Sh RIGHTS
+The following rights may be specified in a new capability rights mask:
+.Bl -tag -width CAP_EXTATTR_DELETE
+.It Dv CAP_ACCEPT
+Permit
+.Xr accept 2 .
+.It Dv CAP_ACL_CHECK
+Permit checking of an ACL on a file descriptor; there is no cross-reference
+for this system call.
+.It Dv CAP_ACL_DELETE
+Permit
+.Xr acl_delete_fd_np 2 .
+.It Dv CAP_ACL_GET
+Permit
+.Xr acl_get_fd 2
+and
+.Xr acl_get_fd_np 2 .
+.It Dv CAP_ACL_SET
+Permit
+.Xr acl_set_fd 2
+and
+.Xr acl_set_fd_np 2 .
+.It Dv CAP_BIND
+Permit
+.Xr bind 2 .
+Note that sockets can also become bound implicitly as a result of
+.Xr connect 2
+or
+.Xr send 2 ,
+and that socket options set with
+.Xr setsockopt 2
+may also affect binding behavior.
+.It Dv CAP_CONNECT
+Permit
+.Xr connect 2 ;
+also required for
+.Xr sendto 2
+with a non-NULL destination address.
+.It Dv CAP_EVENT
+Permit
+.Xr select 2 ,
+.Xr poll 2 ,
+and
+.Xr kevent 2
+to be used in monitoring the file descriptor for events.
+.It Dv CAP_FEXECVE
+Permit
+.Xr fexecve 2 ;
+.Dv CAP_READ
+will also be required.
+.It Dv CAP_EXTATTR_DELETE
+Permit
+.Xr extattr_delete_fd 2 .
+.It Dv CAP_EXTATTR_GET
+Permit
+.Xr extattr_get_fd 2 .
+.It Dv CAP_EXTATTR_LIST
+Permit
+.Xr extattr_list_fd 2 .
+.It Dv CAP_EXTATTR_SET
+Permit
+.Xr extattr_set_fd 2 .
+.It Dv CAP_FCHDIR
+Permit
+.Xr fchdir 2 .
+.It Dv CAP_FCHFLAGS
+Permit
+.Xr fchflags 2 .
+.It Dv CAP_FCHMOD
+Permit
+.Xr fchmod 2 .
+.It Dv CAP_FCHOWN
+Permit
+.Xr fchown 2 .
+.It Dv CAP_FCNTL
+Permit
+.Xr fcntl 2 ;
+be aware that this call provides indirect access to other operations, such as
+.Xr flock 2 .
+.It Dv CAP_FLOCK
+Permit
+.Xr flock 2
+and related calls.
+.It Dv CAP_FPATHCONF
+Permit
+.Xr fpathconf 2 .
+.It Dv CAP_FSCK
+Permit UFS background-fsck operations on the descriptor.
+.It Dv CAP_FSTAT
+Permit
+.Xr fstat 2 .
+.It Dv CAP_FSTATFS
+Permit
+.Xr fstatfs 2 .
+.It Dv CAP_FSYNC
+Permit
+.Xr aio_fsync 2
+and
+.Xr fsync 2 .
+.Pp
+.It Dv CAP_FTRUNCATE
+Permit
+.Xr ftruncate 2 .
+.It Dv CAP_FUTIMES
+Permit
+.Xr futimes 2 .
+.It Dv CAP_GETPEERNAME
+Permit
+.Xr getpeername 2 .
+.It Dv CAP_GETSOCKNAME
+Permit
+.Xr getsockname 2 .
+.It Dv CAP_GETSOCKOPT
+Permit
+.Xr getsockopt 2 .
+.It Dv CAP_IOCTL
+Permit
+.Xr ioctl 2 .
+Be aware that this system call has enourmous scope, including potentially
+global scope for some objects.
+.It Dv CAP_KEVENT
+Permit
+.Xr kevent 2 ;
+.Dv CAP_EVENT
+may also be required on file descriptors to be monitored using
+.Xr kevent 2 .
+.It Dv CAP_LISTEN
+Permit
+.Xr listen 2 ;
+not much use (generally) without
+.Dv CAP_BIND .
+.It Dv CAP_LOOKUP
+Permit the file descriptor to be used as a starting directory for calls such
+as
+.Xr linkat 2 ,
+.Xr openat 2 ,
+and
+.Xr unlinkat 2 .
+Note that these calls are not available in capability mode as they manipulate
+a global name space; see
+.Xr cap_enter 2
+for details.
+.It Dv CAP_MAC_GET
+Permit
+.Xr mac_get_fd 2 .
+.It Dv CAP_MAC_SET
+Permit
+.Xr mac_set_fd 2 .
+.It Dv CAP_MMAP
+Permit
+.Xr mmap 2 ;
+specific invocations may also require
+.Dv CAP_READ
+or
+.Dv CAP_WRITE .
+.Pp
+.It Dv CAP_PDGETPID
+Permit
+.Xr pdgetpid 2 .
+.It Dv CAP_PDKILL
+Permit
+.Xr pdkill 2 .
+.It Dv CAP_PDWAIT
+Permit
+.Xr pdwait 2 .
+.It Dv CAP_PEELOFF
+Permit
+.Xr sctp_peeloff 2 .
+.It Dv CAP_READ
+Allow
+.Xr aio_read 2 ,
+.Xr pread 2 ,
+.Xr read 2 ,
+.Xr recv 2 ,
+.Xr recvfrom 2 ,
+.Xr recvmsg 2 ,
+and related system calls.
+.Pp
+For files and other seekable objects,
+.Dv CAP_SEEK
+may also be required.
+.It Dv CAP_REVOKE
+Permit
+.Xr frevoke 2
+in certain ABI compatibility modes that support this system call.
+.It Dv CAP_SEEK
+Permit operations that seek on the file descriptor, such as
+.Xr lseek 2 ,
+but also required for I/O system calls that modify the file offset, such as
+.Xr read 2
+and
+.Xr write 2 .
+.It Dv CAP_SEM_GETVALUE
+Permit
+.Xr sem_getvalue 3 .
+.It Dv CAP_SEM_POST
+Permit
+.Xr sem_post 3 .
+.It Dv CAP_SEM_WAIT
+Permit
+.Xr sem_wait 3
+and
+.Xr sem_trywait 3 .
+.It Dv CAP_SETSOCKOPT
+Permit
+.Xr setsockopt 2 ;
+this controls various aspects of socket behavior and may affect binding,
+connecting, and other behaviors with global scope.
+.It Dv CAP_SHUTDOWN
+Permit explicit
+.Xr shutdown 2 ;
+closing the socket will also generally shut down any connections on it.
+.It Dv CAP_TTYHOOK
+Allow configuration of TTY hooks, such as
+.Xr snp 4 ,
+on the file descriptor.
+.It Dv CAP_WRITE
+Allow
+.Xr aio_write 2 ,
+.Xr pwrite 2 ,
+.Xr send 2 ,
+.Xr sendmsg 2 ,
+.Xr sendto 2 ,
+.Xr write 2 ,
+and related system calls.
+.Pp
+For files and other seekable objects,
+.Dv CAP_SEEK
+may also be required.
+.Pp
+For
+.Xr sendto 2
+with a non-NULL connection address,
+.Dv CAP_CONNECT
+is also required.
+.El
+.Sh CAVEAT
+The
+.Fn cap_new
+system call and the capabilities it creates may be used to assign
+fine-grained rights to sandboxed processes running in capability mode.
+However, the semantics of objects accessed via file descriptors are complex,
+so caution should be exercised in passing object capabilities into sandboxes.
+.Sh RETURN VALUES
+If successful,
+.Fn cap_new
+returns a non-negative integer, termed a file descriptor.
+It returns -1 on failure, and sets
+.Va errno
+to indicate the error.
+.Pp
+.Rv -std cap_getrights
+.Sh ERRORS
+.Fn cap_new
+may return the following errors:
+.Bl -tag -width Er
+.It Bq Er EBADF
+The
+.Fa fd
+argument is not a valid active descriptor.
+.It Bq Er EINVAL
+An invalid right has been requested in
+.Fa rights .
+.It Bq Er EMFILE
+The process has already reached its limit for open file descriptors.
+.It Bq Er ENFILE
+The system file table is full.
+.It Bq Er EPERM
+.Fa rights
+contains requested rights not present in the current rights mask associated
+with the capability referenced by
+.Fa fd ,
+if any.
+.El
+.Pp
+.Fn cap_getrights
+may return the following errors:
+.Bl -tag -width Er
+.It Bq Er EBADF
+The
+.Fa fd
+argument is not a valid active descriptor.
+.It Bq Er EINVAL
+The
+.Fa fd
+argument is not a capability.
+.El
+.Sh SEE ALSO
+.Xr accept 2 ,
+.Xr acl_delete_fd_np 2 ,
+.Xr acl_get_fd 2 ,
+.Xr acl_get_fd_np 2 ,
+.Xr acl_set_fd_np 2 ,
+.Xr aio_read 2 ,
+.Xr aio_fsync 2 ,
+.Xr aio_write 2 ,
+.Xr bind 2 ,
+.Xr cap_enter 2 ,
+.Xr connect 2 ,
+.Xr dup 2 ,
+.Xr dup2 2 ,
+.Xr extattr_delete_fd 2 ,
+.Xr extattr_get_fd 2 ,
+.Xr extattr_list_fd 2 ,
+.Xr extattr_set_fd 2 ,
+.Xr fchflags 2 ,
+.Xr fchown 2 ,
+.Xr fcntl 2 ,
+.Xr fexecve 2 ,
+.Xr fhopen 2 ,
+.Xr flock 2 ,
+.Xr fpathconf 2 ,
+.Xr fstat 2 ,
+.Xr fstatfs 2 ,
+.Xr fsync 2 ,
+.Xr ftruncate 2 ,
+.Xr futimes 2 ,
+.Xr getpeername 2 ,
+.Xr getsockname 2 ,
+.Xr getsockopt 2 ,
+.Xr ioctl 2 ,
+.Xr kevent 2 ,
+.Xr kqueue 2 ,
+.Xr linkat 2 ,
+.Xr listen 2 ,
+.Xr mac_get_fd 2 ,
+.Xr mac_set_fd 2 ,
+.Xr mmap 2 ,
+.Xr mq_open 2 ,
+.Xr open 2 ,
+.Xr openat 2 ,
+.Xr pdgetpid 2 ,
+.Xr pdkill 2 ,
+.Xr pdwait 2 ,
+.Xr pipe 2 ,
+.Xr poll 2 ,
+.Xr pread 2 ,
+.Xr pwrite 2 ,
+.Xr read 2 ,
+.Xr recv 2 ,
+.Xr recvfrom 2 ,
+.Xr recvmsg 2 ,
+.Xr sctp_peeloff 2 ,
+.Xr select 2 ,
+.Xr send 2 ,
+.Xr sendmsg 2 ,
+.Xr sendto 2 ,
+.Xr setsockopt 2 ,
+.Xr shm_open 2 ,
+.Xr shutdown 2 ,
+.Xr socket 2 ,
+.Xr socketpair 2 ,
+.Xr unlinkat 2 ,
+.Xr write 2 ,
+.Xr cap_limitfd 3 ,
+.Xr libcapability 3 ,
+.Xr sem_getvalue 3 ,
+.Xr sem_post 3 ,
+.Xr sem_trywait 3 ,
+.Xr sem_wait 3 ,
+.Xr snp 4
+.Sh HISTORY
+Support for capabilities and capabilities mode was developed as part of the
+.Tn TrustedBSD
+Project.
+.Sh BUGS
+This man page should list the set of permitted system calls more specifically
+for each capability right.
+.Pp
+Capability rights sometimes have unclear indirect impacts, which should be
+documented, or at least hinted at.
+.Pp
+WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED ON IN
+PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND UNEXPECTED WAYS.
+.Sh AUTHORS
+These functions and the capability facility were created by
+.An "Robert N. M. Watson"
+at the University of Cambridge Computer Laboratory with support from a grant
+from Google, Inc.
Modified: projects/capabilities8/lib/libc/sys/fork.2
==============================================================================
--- projects/capabilities8/lib/libc/sys/fork.2 Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/lib/libc/sys/fork.2 Thu Oct 8 22:21:53 2009 (r197881)
@@ -122,6 +122,7 @@ There is insufficient swap space for the
.El
.Sh SEE ALSO
.Xr execve 2 ,
+.Xr pdfork 2 ,
.Xr rfork 2 ,
.Xr setitimer 2 ,
.Xr setrlimit 2 ,
Modified: projects/capabilities8/lib/libc/sys/intro.2
==============================================================================
--- projects/capabilities8/lib/libc/sys/intro.2 Thu Oct 8 21:53:58 2009 (r197880)
+++ projects/capabilities8/lib/libc/sys/intro.2 Thu Oct 8 22:21:53 2009 (r197881)
@@ -456,6 +456,9 @@ The specified extended attribute does no
.It Er 88 EDOOFUS Em "Programming error" .
A function or API is being abused in a way which could only be detected
at run-time.
+.It Er 93 ENOTCAPABLE Em "Capabilities insufficient" .
+An operation on a capability file descriptor requires greater privilege than
+the capability allows.
.El
.Sh DEFINITIONS
.Bl -tag -width Ds
Added: projects/capabilities8/lib/libc/sys/pdfork.2
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ projects/capabilities8/lib/libc/sys/pdfork.2 Thu Oct 8 22:21:53 2009 (r197881)
@@ -0,0 +1,123 @@
+.\"
+.\" Copyright (c) 2009 Robert N. M. Watson
+.\" All rights reserved.
+.\"
+.\" WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED
+.\" ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND
+.\" UNEXPECTED WAYS.
+.\"
+.\" This software was developed at the University of Cambridge Computer
+.\" Laboratory with support from a grant from Google, Inc.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd January 18, 2009
+.Dt PDFORK 2
+.Os
+.Sh NAME
+.Nm pdfork ,
+.Nm pdgetpid ,
+.Nm pdkill ,
+.Nm pdwait
+.Nd System calls to manage process descriptors
+.Sh LIBRARY
+.Lb libc
+.Sh SYNOPSIS
+.In sys/procdesc.h
+.Ft int
+.Fn pdfork "int *fdp"
+.Ft int
+.Fn pdgetpid "int fd" "pid_t *pidp"
+.Ft int
+.Fn pdkill "int fd" "int signum"
+.Ft int
+.Fn pdwait "int fd" "int *status" "int options" "struct rusage *rusage"
+.Sh DESCRIPTION
+Process descriptors are special file descriptors that represent processes,
+and are created using
+.Fn pdfork ,
+a variant of
+.Xr fork 2 ,
+which, if successful, returns a process descriptor in the integer pointed to
+by
+.Fa pidp .
+.Pp
+.Fn pdgetpid
+queries the process ID (PID) if the process descriptor
+.Fa fd .
+.Pp
+.Fn pdkill
+is functionally identical to
+.Xr kill 2 ,
+except that it accepts a process descriptor,
+.Fa fd ,
+rather than a PID.
+.Pp
+.Fn pdwait
+is currently unimplemented, but in the future will be functionally identical
+to
+.Xr wait4 2 ,
+except that it accepts a process descriptor rather than a PID.
+.Pp
+The following system calls also have effects specific to process descriptors:
+.Pp
+.Xr fstat 2
+queries status of a process descriptor; currently only the
+.Fa sb_mode
+field is defined; if the owner read, write, and execute bits are set then the
+process represented by the process descriptor is still alive.
+.Pp
+.Xr poll 2
+allows waiting for process state transitions; currently only
+.Dv POLLHUP
+is defined, and will be raised when the process dies.
+.Pp
+.Xr close 2
+will close the process descriptor, and if the process is still alive,
+terminate it with the signal
+.Dv SIGKILL .
+.Sh RETURN VALUES
+.Sh ERRORS
+.Sh SEE ALSO
+.Xr close 2 ,
+.Xr fork 2 ,
+.Xr fstat 2 ,
+.Xr kill 2 ,
+.Xr poll 2 ,
+.Xr wait4 2
+.Sh HISTORY
+Support for process descriptors mode was developed as part of the
+.Tn TrustedBSD
+Project.
+.Sh BUGS
+.Fn pdwait
*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
More information about the svn-src-projects
mailing list