svn commit: r340130 - head/lib/libcapsicum
Mariusz Zaborski
oshogbo at FreeBSD.org
Sun Nov 4 17:23:00 UTC 2018
Author: oshogbo
Date: Sun Nov 4 17:22:58 2018
New Revision: 340130
URL: https://svnweb.freebsd.org/changeset/base/340130
Log:
libcapsicum: Introduce caph_{rights,ioctls,fcntls}_limit
The idea behind those functions is not to force consumers to remember that there
is a need to check errno on failure. We already have a caph_enter(3) function
which does the same for cap_enter(2).
MFC after: 2 weeks
Modified:
head/lib/libcapsicum/Makefile
head/lib/libcapsicum/capsicum_helpers.3
head/lib/libcapsicum/capsicum_helpers.h
Modified: head/lib/libcapsicum/Makefile
==============================================================================
--- head/lib/libcapsicum/Makefile Sun Nov 4 17:12:53 2018 (r340129)
+++ head/lib/libcapsicum/Makefile Sun Nov 4 17:22:58 2018 (r340130)
@@ -8,6 +8,7 @@ MAN+= capsicum_helpers.3
MLINKS+=capsicum_helpers.3 caph_enter.3
MLINKS+=capsicum_helpers.3 caph_enter_casper.3
+MLINKS+=capsicum_helpers.3 caph_rights_limit.3
MLINKS+=capsicum_helpers.3 caph_limit_stream.3
MLINKS+=capsicum_helpers.3 caph_limit_stdin.3
MLINKS+=capsicum_helpers.3 caph_limit_stderr.3
Modified: head/lib/libcapsicum/capsicum_helpers.3
==============================================================================
--- head/lib/libcapsicum/capsicum_helpers.3 Sun Nov 4 17:12:53 2018 (r340129)
+++ head/lib/libcapsicum/capsicum_helpers.3 Sun Nov 4 17:22:58 2018 (r340130)
@@ -24,7 +24,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd July 18, 2018
+.Dd November 4, 2018
.Dt CAPSICUM_HELPERS 3
.Os
.Sh NAME
@@ -34,7 +34,12 @@
.Nm caph_limit_stdout ,
.Nm caph_limit_stdio ,
.Nm caph_cache_tzdata ,
-.Nm caph_cache_catpages
+.Nm caph_cache_catpages ,
+.Nm caph_enter ,
+.Nm caph_enter_casper ,
+.Nm caph_rights_limit ,
+.Nm caph_ioctls_limit ,
+.Nm caph_fcntls_limit
.Nd "set of the capsicum helpers, part of the libcapsicum"
.Sh LIBRARY
.Lb libcapsicum
@@ -45,8 +50,12 @@
.Ft int
.Fn caph_enter_casper "void"
.Ft int
-.Fn caph_limit_stream "int fd" "int flags"
+.Fn caph_rights_limit "inf fd" "const cap_righst_t *rights"
.Ft int
+.Fn caph_ioctls_limit "inf fd" "const unsigned long *cmds" "size_t ncmds"
+.Ft int
+.Fn caph_fcntls_limit "inf fd" "uint32_t fcntlrights"
+.Ft int
.Fn caph_limit_stdin "void"
.Ft int
.Fn caph_limit_stderr "void"
@@ -60,9 +69,17 @@
.Fn caph_cache_catpages "void"
.Sh DESCRIPTION
The
-.Nm caph_enter
-is equivalent to the
-.Xr cap_enter 2
+.Nm caph_enter ,
+.Nm caph_rights_limit ,
+.Nm caph_ioctls_limit
+and
+.Nm caph_fcntls_limit
+are respectively equivalent to
+.Xr cap_enter 2 ,
+.Xr cap_rights_limit 2 ,
+.Xr cap_ioctls_limit 2
+and
+.Xr cap_fcntls_limit 2 ,
it returns success when the kernel is built without support of the capability
mode.
.Pp
@@ -125,4 +142,5 @@ among others.
.Ed
.Sh SEE ALSO
.Xr cap_enter 2 ,
+.Xr cap_rights_limit 2 ,
.Xr rights 4
Modified: head/lib/libcapsicum/capsicum_helpers.h
==============================================================================
--- head/lib/libcapsicum/capsicum_helpers.h Sun Nov 4 17:12:53 2018 (r340129)
+++ head/lib/libcapsicum/capsicum_helpers.h Sun Nov 4 17:22:58 2018 (r340130)
@@ -136,6 +136,35 @@ caph_enter(void)
return (0);
}
+static __inline int
+caph_rights_limit(int fd, const cap_rights_t *rights)
+{
+
+ if (cap_rights_limit(fd, rights) < 0 && errno != ENOSYS)
+ return (-1);
+
+ return (0);
+}
+
+static __inline int
+caph_ioctls_limit(int fd, const unsigned long *cmds, size_t ncmds)
+{
+
+ if (cap_ioctls_limit(fd, cmds, ncmds) < 0 && errno != ENOSYS)
+ return (-1);
+
+ return (0);
+}
+
+static __inline int
+caph_fcntls_limit(int fd, uint32_t fcntlrights)
+{
+
+ if (caph_fcntls_limit(fd, fcntlrights) < 0 && errno != ENOSYS)
+ return (-1);
+
+ return (0);
+}
static __inline int
caph_enter_casper(void)
More information about the svn-src-head
mailing list