From owner-svn-src-projects@FreeBSD.ORG Thu Oct 8 22:21:54 2009 Return-Path: Delivered-To: svn-src-projects@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 19A501065679; Thu, 8 Oct 2009 22:21:54 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 04A2C8FC17; Thu, 8 Oct 2009 22:21:54 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n98MLsMk035205; Thu, 8 Oct 2009 22:21:54 GMT (envelope-from rwatson@svn.freebsd.org) Received: (from rwatson@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n98MLrY6035185; Thu, 8 Oct 2009 22:21:53 GMT (envelope-from rwatson@svn.freebsd.org) Message-Id: <200910082221.n98MLrY6035185@svn.freebsd.org> From: Robert Watson Date: Thu, 8 Oct 2009 22:21:53 +0000 (UTC) To: src-committers@freebsd.org, svn-src-projects@freebsd.org X-SVN-Group: projects MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r197881 - in projects/capabilities8: contrib/openbsm/libbsm contrib/openbsm/sys/bsm contrib/tcpdump crypto/openssh gnu/usr.bin/groff/tmac lib lib/libc/gen lib/libc/sys lib/libcapability... X-BeenThere: svn-src-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the src " projects" tree" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2009 22:21:54 -0000 Author: rwatson Date: Thu Oct 8 22:21:53 2009 New Revision: 197881 URL: http://svn.freebsd.org/changeset/base/197881 Log: Merge TrustedBSD capabilities prototype snapshot from Perforce to capabilities8 project branch; primary development will continue in Perforce, but this branch will allow 8.x users to work with the capabilities parts without braving 9.x. Obtained from: TrustedBSD Project Sponsored by: Google Added: projects/capabilities8/lib/libc/gen/ld_caplibindex.c (contents, props changed) projects/capabilities8/lib/libc/gen/ld_sandbox.c (contents, props changed) projects/capabilities8/lib/libc/sys/cap_enter.2 (contents, props changed) projects/capabilities8/lib/libc/sys/cap_new.2 (contents, props changed) projects/capabilities8/lib/libc/sys/pdfork.2 (contents, props changed) projects/capabilities8/lib/libcapability/ projects/capabilities8/lib/libcapability/Makefile (contents, props changed) projects/capabilities8/lib/libcapability/libcapability.3 (contents, props changed) projects/capabilities8/lib/libcapability/libcapability.c (contents, props changed) projects/capabilities8/lib/libcapability/libcapability.h (contents, props changed) projects/capabilities8/lib/libcapability/libcapability_host.3 (contents, props changed) projects/capabilities8/lib/libcapability/libcapability_host.c (contents, props changed) projects/capabilities8/lib/libcapability/libcapability_host_io.c (contents, props changed) projects/capabilities8/lib/libcapability/libcapability_internal.h (contents, props changed) projects/capabilities8/lib/libcapability/libcapability_sandbox.3 (contents, props changed) projects/capabilities8/lib/libcapability/libcapability_sandbox.c (contents, props changed) projects/capabilities8/lib/libcapability/libcapability_sandbox_api.h (contents, props changed) projects/capabilities8/lib/libcapability/libcapability_sandbox_io.c (contents, props changed) projects/capabilities8/libexec/rtld-elf-cap/ projects/capabilities8/libexec/rtld-elf-cap/Makefile (contents, props changed) projects/capabilities8/libexec/rtld-elf-cap/Symbol.map projects/capabilities8/libexec/rtld-elf-cap/rtld-elf-cap.1 (contents, props changed) projects/capabilities8/libexec/rtld-elf-cap/rtld-elf-cap.xs projects/capabilities8/libexec/rtld-elf-cap/rtld_caplibindex.c (contents, props changed) projects/capabilities8/libexec/rtld-elf-cap/rtld_caplibindex.h (contents, props changed) projects/capabilities8/libexec/rtld-elf-cap/rtld_sandbox.c (contents, props changed) projects/capabilities8/libexec/rtld-elf-cap/rtld_sandbox.h (contents, props changed) projects/capabilities8/sys/kern/capabilities.conf (contents, props changed) projects/capabilities8/sys/kern/sys_capability.c (contents, props changed) projects/capabilities8/sys/kern/sys_procdesc.c (contents, props changed) projects/capabilities8/sys/sys/capability.h (contents, props changed) projects/capabilities8/sys/sys/procdesc.h (contents, props changed) projects/capabilities8/usr.bin/gzip/gzsandbox.c (contents, props changed) Modified: projects/capabilities8/contrib/openbsm/libbsm/bsm_errno.c projects/capabilities8/contrib/openbsm/sys/bsm/audit_errno.h projects/capabilities8/contrib/tcpdump/tcpdump.c projects/capabilities8/crypto/openssh/sshd.c projects/capabilities8/gnu/usr.bin/groff/tmac/mdoc.local projects/capabilities8/lib/Makefile projects/capabilities8/lib/libc/gen/Makefile.inc projects/capabilities8/lib/libc/gen/Symbol.map projects/capabilities8/lib/libc/gen/errlst.c projects/capabilities8/lib/libc/sys/Makefile.inc projects/capabilities8/lib/libc/sys/Symbol.map projects/capabilities8/lib/libc/sys/fork.2 projects/capabilities8/lib/libc/sys/intro.2 projects/capabilities8/lib/libkvm/kvm_proc.c projects/capabilities8/libexec/Makefile projects/capabilities8/libexec/rtld-elf/Makefile projects/capabilities8/libexec/rtld-elf/map_object.c projects/capabilities8/libexec/rtld-elf/rtld.c projects/capabilities8/sbin/dhclient/dhclient.c projects/capabilities8/share/mk/bsd.libnames.mk projects/capabilities8/sys/amd64/amd64/sys_machdep.c projects/capabilities8/sys/amd64/linux32/linux32_machdep.c projects/capabilities8/sys/amd64/linux32/linux32_proto.h projects/capabilities8/sys/amd64/linux32/linux32_syscall.h projects/capabilities8/sys/amd64/linux32/linux32_sysent.c projects/capabilities8/sys/arm/arm/sys_machdep.c projects/capabilities8/sys/bsm/audit_errno.h projects/capabilities8/sys/cddl/compat/opensolaris/sys/file.h projects/capabilities8/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c projects/capabilities8/sys/compat/freebsd32/freebsd32_proto.h projects/capabilities8/sys/compat/freebsd32/freebsd32_syscall.h projects/capabilities8/sys/compat/freebsd32/freebsd32_syscalls.c projects/capabilities8/sys/compat/freebsd32/freebsd32_sysent.c projects/capabilities8/sys/compat/freebsd32/syscalls.master projects/capabilities8/sys/compat/linux/linux_file.c projects/capabilities8/sys/compat/linux/linux_ioctl.c projects/capabilities8/sys/compat/linux/linux_socket.c projects/capabilities8/sys/compat/linux/linux_stats.c projects/capabilities8/sys/compat/svr4/svr4_fcntl.c projects/capabilities8/sys/compat/svr4/svr4_filio.c projects/capabilities8/sys/compat/svr4/svr4_ioctl.c projects/capabilities8/sys/compat/svr4/svr4_proto.h projects/capabilities8/sys/compat/svr4/svr4_stream.c projects/capabilities8/sys/compat/svr4/svr4_syscall.h projects/capabilities8/sys/compat/svr4/svr4_syscallnames.c projects/capabilities8/sys/compat/svr4/svr4_sysent.c projects/capabilities8/sys/conf/NOTES projects/capabilities8/sys/conf/files projects/capabilities8/sys/conf/options projects/capabilities8/sys/dev/aac/aac_linux.c projects/capabilities8/sys/dev/amr/amr_linux.c projects/capabilities8/sys/dev/hwpmc/hwpmc_logging.c projects/capabilities8/sys/dev/ipmi/ipmi_linux.c projects/capabilities8/sys/dev/iscsi/initiator/iscsi.c projects/capabilities8/sys/dev/mfi/mfi_linux.c projects/capabilities8/sys/dev/snp/snp.c projects/capabilities8/sys/dev/tdfx/tdfx_linux.c projects/capabilities8/sys/fs/fdescfs/fdesc_vnops.c projects/capabilities8/sys/fs/nfs/nfsport.h projects/capabilities8/sys/fs/nfsclient/nfs_clport.c projects/capabilities8/sys/fs/nfsserver/nfs_nfsdport.c projects/capabilities8/sys/fs/portalfs/portal_vfsops.c projects/capabilities8/sys/fs/portalfs/portal_vnops.c projects/capabilities8/sys/gnu/fs/xfs/xfs_dfrag.c projects/capabilities8/sys/i386/i386/sys_machdep.c projects/capabilities8/sys/i386/i386/trap.c projects/capabilities8/sys/i386/ibcs2/ibcs2_fcntl.c projects/capabilities8/sys/i386/ibcs2/ibcs2_ioctl.c projects/capabilities8/sys/i386/ibcs2/ibcs2_proto.h projects/capabilities8/sys/i386/ibcs2/ibcs2_syscall.h projects/capabilities8/sys/i386/ibcs2/ibcs2_sysent.c projects/capabilities8/sys/i386/linux/linux_machdep.c projects/capabilities8/sys/i386/linux/linux_proto.h projects/capabilities8/sys/i386/linux/linux_syscall.h projects/capabilities8/sys/i386/linux/linux_sysent.c projects/capabilities8/sys/kern/Makefile projects/capabilities8/sys/kern/imgact_elf.c projects/capabilities8/sys/kern/init_sysent.c projects/capabilities8/sys/kern/kern_descrip.c projects/capabilities8/sys/kern/kern_event.c projects/capabilities8/sys/kern/kern_exec.c projects/capabilities8/sys/kern/kern_exit.c projects/capabilities8/sys/kern/kern_fork.c projects/capabilities8/sys/kern/kern_mib.c projects/capabilities8/sys/kern/kern_sig.c projects/capabilities8/sys/kern/kern_sysctl.c projects/capabilities8/sys/kern/makesyscalls.sh projects/capabilities8/sys/kern/posix4_mib.c projects/capabilities8/sys/kern/subr_smp.c projects/capabilities8/sys/kern/sys_generic.c projects/capabilities8/sys/kern/syscalls.c projects/capabilities8/sys/kern/syscalls.master projects/capabilities8/sys/kern/systrace_args.c projects/capabilities8/sys/kern/tty.c projects/capabilities8/sys/kern/uipc_mqueue.c projects/capabilities8/sys/kern/uipc_sem.c projects/capabilities8/sys/kern/uipc_shm.c projects/capabilities8/sys/kern/uipc_syscalls.c projects/capabilities8/sys/kern/uipc_usrreq.c projects/capabilities8/sys/kern/vfs_acl.c projects/capabilities8/sys/kern/vfs_aio.c projects/capabilities8/sys/kern/vfs_extattr.c projects/capabilities8/sys/kern/vfs_lookup.c projects/capabilities8/sys/kern/vfs_syscalls.c projects/capabilities8/sys/netgraph/ng_socket.c projects/capabilities8/sys/nfsserver/nfs_srvkrpc.c projects/capabilities8/sys/security/audit/audit.h projects/capabilities8/sys/security/audit/audit_arg.c projects/capabilities8/sys/security/audit/audit_bsm.c projects/capabilities8/sys/security/audit/audit_bsm_errno.c projects/capabilities8/sys/security/audit/audit_private.h projects/capabilities8/sys/security/mac/mac_syscalls.c projects/capabilities8/sys/sparc64/sparc64/sys_machdep.c projects/capabilities8/sys/sys/_types.h projects/capabilities8/sys/sys/errno.h projects/capabilities8/sys/sys/file.h projects/capabilities8/sys/sys/filedesc.h projects/capabilities8/sys/sys/proc.h projects/capabilities8/sys/sys/syscall.h projects/capabilities8/sys/sys/syscall.mk projects/capabilities8/sys/sys/sysctl.h projects/capabilities8/sys/sys/sysent.h projects/capabilities8/sys/sys/sysproto.h projects/capabilities8/sys/sys/types.h projects/capabilities8/sys/sys/ucred.h projects/capabilities8/sys/sys/unistd.h projects/capabilities8/sys/sys/user.h projects/capabilities8/sys/ufs/ffs/ffs_alloc.c projects/capabilities8/sys/vm/vm_mmap.c projects/capabilities8/usr.bin/gzip/Makefile projects/capabilities8/usr.bin/gzip/gzip.c projects/capabilities8/usr.bin/gzip/unbzip2.c projects/capabilities8/usr.bin/procstat/procstat.1 projects/capabilities8/usr.bin/procstat/procstat.c projects/capabilities8/usr.bin/procstat/procstat.h projects/capabilities8/usr.bin/procstat/procstat_cred.c projects/capabilities8/usr.bin/procstat/procstat_files.c Modified: projects/capabilities8/contrib/openbsm/libbsm/bsm_errno.c ============================================================================== --- projects/capabilities8/contrib/openbsm/libbsm/bsm_errno.c Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/contrib/openbsm/libbsm/bsm_errno.c Thu Oct 8 22:21:53 2009 (r197881) @@ -684,6 +684,13 @@ static const struct bsm_errno bsm_errnos ERRNO_NO_LOCAL_MAPPING, #endif ES("Key was rejected by service") }, + { BSM_ERRNO_ENOTCAPABLE, +#ifdef ENOTCAPABLE + ENOTCAPABLE, +#else + ERRNO_NO_LOCAL_MAPPING, +#endif + ES("Capabilities insufficient") }, }; static const int bsm_errnos_count = sizeof(bsm_errnos) / sizeof(bsm_errnos[0]); Modified: projects/capabilities8/contrib/openbsm/sys/bsm/audit_errno.h ============================================================================== --- projects/capabilities8/contrib/openbsm/sys/bsm/audit_errno.h Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/contrib/openbsm/sys/bsm/audit_errno.h Thu Oct 8 22:21:53 2009 (r197881) @@ -204,6 +204,7 @@ #define BSM_ERRNO_EKEYEXPIRED 220 /* Linux-specific. */ #define BSM_ERRNO_EKEYREVOKED 221 /* Linux-specific. */ #define BSM_ERRNO_EKEYREJECTED 222 /* Linux-specific. */ +#define BSM_ERRNO_ENOTCAPABLE 223 /* FreeBSD-specific. */ /* * In the event that OpenBSM doesn't have a file representation of a local Modified: projects/capabilities8/contrib/tcpdump/tcpdump.c ============================================================================== --- projects/capabilities8/contrib/tcpdump/tcpdump.c Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/contrib/tcpdump/tcpdump.c Thu Oct 8 22:21:53 2009 (r197881) @@ -1197,6 +1197,8 @@ main(int argc, char **argv) (void)fflush(stderr); } #endif /* WIN32 */ + if (cap_enter() < 0) + err(-1, "cap_enter"); status = pcap_loop(pd, cnt, callback, pcap_userdata); if (WFileName == NULL) { /* Modified: projects/capabilities8/crypto/openssh/sshd.c ============================================================================== --- projects/capabilities8/crypto/openssh/sshd.c Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/crypto/openssh/sshd.c Thu Oct 8 22:21:53 2009 (r197881) @@ -46,6 +46,7 @@ __RCSID("$FreeBSD$"); #include +#include #include #include #ifdef HAVE_SYS_STAT_H @@ -620,6 +621,8 @@ privsep_preauth_child(void) fatal("setgroups: %.100s", strerror(errno)); permanently_set_uid(privsep_pw); #endif + if (cap_enter() != 0 && errno != ENOSYS) + fatal("cap_enter: %.100s", strerror(errno)); } static int Modified: projects/capabilities8/gnu/usr.bin/groff/tmac/mdoc.local ============================================================================== --- projects/capabilities8/gnu/usr.bin/groff/tmac/mdoc.local Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/gnu/usr.bin/groff/tmac/mdoc.local Thu Oct 8 22:21:53 2009 (r197881) @@ -38,6 +38,7 @@ .ds doc-str-Lb-libc_r Reentrant C\~Library (libc_r, \-lc_r) .ds doc-str-Lb-libcalendar Calendar Arithmetic Library (libcalendar, \-lcalendar) .ds doc-str-Lb-libcam Common Access Method User Library (libcam, \-lcam) +.ds doc-str-Lb-libcapability Capability Services Library (libcapability, \-lcapability) .ds doc-str-Lb-libcipher FreeSec Crypt Library (libcipher, \-lcipher) .ds doc-str-Lb-libdevinfo Device and Resource Information Utility Library (libdevinfo, \-ldevinfo) .ds doc-str-Lb-libdevstat Device Statistics Library (libdevstat, \-ldevstat) Modified: projects/capabilities8/lib/Makefile ============================================================================== --- projects/capabilities8/lib/Makefile Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/lib/Makefile Thu Oct 8 22:21:53 2009 (r197881) @@ -32,7 +32,9 @@ SUBDIR= ${_csu} libc libbsm libauditd li ncurses ${_libnetgraph} libradius librpcsvc libsbuf \ libtacplus libutil ${_libypclnt} libalias libarchive ${_libatm} \ libbegemot ${_libbluetooth} ${_libbsnmp} libbz2 \ - libcalendar libcam libcompat libdevinfo libdevstat libdisk \ + libcalendar libcam libcapability libcompat \ + libdevinfo libdevstat \ + libdisk \ libdwarf libedit libexpat libfetch libftpio libgeom ${_libgpib} \ ${_libgssapi} ${_librpcsec_gss} libipsec \ ${_libipx} libjail libkiconv libmagic libmemstat ${_libmilter} \ Modified: projects/capabilities8/lib/libc/gen/Makefile.inc ============================================================================== --- projects/capabilities8/lib/libc/gen/Makefile.inc Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/lib/libc/gen/Makefile.inc Thu Oct 8 22:21:53 2009 (r197881) @@ -19,6 +19,7 @@ SRCS+= __getosreldate.c __xuname.c \ getpeereid.c getprogname.c getpwent.c getttyent.c \ getusershell.c getvfsbyname.c glob.c \ initgroups.c isatty.c isinf.c isnan.c jrand48.c lcong48.c \ + ld_caplibindex.c ld_sandbox.c \ lockf.c lrand48.c mrand48.c nftw.c nice.c \ nlist.c nrand48.c opendir.c \ pause.c pmadvise.c popen.c posix_spawn.c pselect.c \ Modified: projects/capabilities8/lib/libc/gen/Symbol.map ============================================================================== --- projects/capabilities8/lib/libc/gen/Symbol.map Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/lib/libc/gen/Symbol.map Thu Oct 8 22:21:53 2009 (r197881) @@ -341,6 +341,8 @@ FBSD_1.1 { fts_read; fts_set; fts_set_clientptr; + ld_caplibindex_lookup; + ld_insandbox; posix_spawn; posix_spawn_file_actions_addclose; posix_spawn_file_actions_adddup2; Modified: projects/capabilities8/lib/libc/gen/errlst.c ============================================================================== --- projects/capabilities8/lib/libc/gen/errlst.c Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/lib/libc/gen/errlst.c Thu Oct 8 22:21:53 2009 (r197881) @@ -150,5 +150,6 @@ const char *const sys_errlist[] = { "Multihop attempted", /* 90 - EMULTIHOP */ "Link has been severed", /* 91 - ENOLINK */ "Protocol error", /* 92 - EPROTO */ + "Capabilities insufficient", /* 93 - ENOTCAPABLE */ }; const int sys_nerr = sizeof(sys_errlist) / sizeof(sys_errlist[0]); Added: projects/capabilities8/lib/libc/gen/ld_caplibindex.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ projects/capabilities8/lib/libc/gen/ld_caplibindex.c Thu Oct 8 22:21:53 2009 (r197881) @@ -0,0 +1,43 @@ +/*- + * Copyright (c) 2008-2009 Robert N. M. Watson + * All rights reserved. + * + * WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED + * ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND + * UNEXPECTED WAYS. + * + * This software was developed at the University of Cambridge Computer + * Laboratory with support from a grant from Google, Inc. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include + +#pragma weak ld_caplibindex_lookup +int +ld_caplibindex_lookup(const char *libname, int *fdp) +{ + + errno = EOPNOTSUPP; + return (-1); +} Added: projects/capabilities8/lib/libc/gen/ld_sandbox.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ projects/capabilities8/lib/libc/gen/ld_sandbox.c Thu Oct 8 22:21:53 2009 (r197881) @@ -0,0 +1,40 @@ +/*- + * Copyright (c) 2008-2009 Robert N. M. Watson + * All rights reserved. + * + * WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED + * ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND + * UNEXPECTED WAYS. + * + * This software was developed at the University of Cambridge Computer + * Laboratory with support from a grant from Google, Inc. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#pragma weak ld_insandbox +int +ld_insandbox(void) +{ + + return (0); +} Modified: projects/capabilities8/lib/libc/sys/Makefile.inc ============================================================================== --- projects/capabilities8/lib/libc/sys/Makefile.inc Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/lib/libc/sys/Makefile.inc Thu Oct 8 22:21:53 2009 (r197881) @@ -64,7 +64,7 @@ ${SPSEUDO}: MAN+= abort2.2 accept.2 access.2 acct.2 adjtime.2 \ aio_cancel.2 aio_error.2 aio_read.2 aio_return.2 \ aio_suspend.2 aio_waitcomplete.2 aio_write.2 \ - bind.2 brk.2 chdir.2 chflags.2 \ + bind.2 brk.2 cap_enter.2 cap_new.2 chdir.2 chflags.2 \ chmod.2 chown.2 chroot.2 clock_gettime.2 close.2 closefrom.2 \ connect.2 cpuset.2 cpuset_getaffinity.2 dup.2 execve.2 _exit.2 \ extattr_get_file.2 fcntl.2 fhopen.2 flock.2 fork.2 fsync.2 \ @@ -83,7 +83,8 @@ MAN+= abort2.2 accept.2 access.2 acct.2 mq_setattr.2 \ msgctl.2 msgget.2 msgrcv.2 msgsnd.2 \ msync.2 munmap.2 nanosleep.2 nfssvc.2 ntp_adjtime.2 open.2 \ - pathconf.2 pipe.2 poll.2 posix_openpt.2 profil.2 ptrace.2 quotactl.2 \ + pathconf.2 pdfork.2 \ + pipe.2 poll.2 posix_openpt.2 profil.2 ptrace.2 quotactl.2 \ read.2 readlink.2 reboot.2 recv.2 rename.2 revoke.2 rfork.2 rmdir.2 \ rtprio.2 .if !defined(NO_P1003_1B) @@ -104,6 +105,8 @@ MAN+= sctp_generic_recvmsg.2 sctp_generi MLINKS+=access.2 eaccess.2 access.2 faccessat.2 MLINKS+=brk.2 sbrk.2 +MLINKS+=cap_enter.2 cap_getmode.2 +MLINKS+=cap_new.2 cap_getrights.2 MLINKS+=chdir.2 fchdir.2 MLINKS+=chflags.2 fchflags.2 chflags.2 lchflags.2 MLINKS+=chmod.2 fchmod.2 chmod.2 fchmodat.2 chmod.2 lchmod.2 @@ -161,6 +164,9 @@ MLINKS+=ntp_adjtime.2 ntp_gettime.2 MLINKS+=open.2 openat.2 MLINKS+=pathconf.2 fpathconf.2 MLINKS+=pathconf.2 lpathconf.2 +MLINKS+=pdfork.2 pdgetpid.2 \ + pdfork.2 pdkill.2 \ + pdfork.2 pdwait4.2 MLINKS+=read.2 pread.2 read.2 preadv.2 read.2 readv.2 MLINKS+=readlink.2 readlinkat.2 MLINKS+=recv.2 recvfrom.2 recv.2 recvmsg.2 Modified: projects/capabilities8/lib/libc/sys/Symbol.map ============================================================================== --- projects/capabilities8/lib/libc/sys/Symbol.map Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/lib/libc/sys/Symbol.map Thu Oct 8 22:21:53 2009 (r197881) @@ -329,6 +329,10 @@ FBSD_1.0 { FBSD_1.1 { __semctl; + cap_enter; + cap_getmode; + cap_getrights; + cap_new; closefrom; cpuset; cpuset_getid; @@ -351,6 +355,10 @@ FBSD_1.1 { mknodat; msgctl; openat; + pdfork; + pdgetpid; + pdkill; + pdwait4; readlinkat; renameat; setfib; Added: projects/capabilities8/lib/libc/sys/cap_enter.2 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ projects/capabilities8/lib/libc/sys/cap_enter.2 Thu Oct 8 22:21:53 2009 (r197881) @@ -0,0 +1,112 @@ +.\" +.\" Copyright (c) 2008-2009 Robert N. M. Watson +.\" All rights reserved. +.\" +.\" WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED +.\" ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND +.\" UNEXPECTED WAYS. +.\" +.\" This software was developed at the University of Cambridge Computer +.\" Laboratory with support from a grant from Google, Inc. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd June 11, 2009 +.Dt CAP_ENTER 2 +.Os +.Sh NAME +.Nm cap_enter , +.Nm cap_getmode +.Nd Capability mode system calls +.Sh LIBRARY +.Lb libc +.Sh SYNOPSIS +.In sys/capability.h +.Ft int +.Fn cap_enter "void" +.Ft int +.Fn cap_getmode "u_int *modep" +.Sh DESCRIPTION +.Fn cap_enter +places the current process into capability mode, a mode of execution in which +processes may only issue system calls operating on file descriptors or +reading limited global system state. +Access to global name spaces, such as file system or IPC name spaces, is +prevented. +If the process is already in a capability mode sandbox, the system call is a +no-op. +Future process descendants create with +.Xr fork 2 +or +.Xr pdfork 2 +will be placed in capability mode from inception. +.Pp +When combined with capabilities created with +.Xr cap_new 2 , +.Fn cap_enter +may be used to create kernel-enforced sandboxes in which +appropriately-crafted applications or application components may be run. +Most sandboxes will be created and managed using the +.Xr libcapability +library, rather than using system calls directly. +.Pp +.Fn cap_getmode +returns a flag indicating whether or not the process is in a capability mode +sandbox. +.Sh CAVEAT +Creating effecive process sandboxes is a tricky process that involves +identifying the least possible rights required by the process and then +passing those rights into the process in a safe manner. +See the CAVEAT +section of +.Xr cap_new 2 +for why this is particularly tricky with UNIX file descriptors as the +canonical representation of a right. +Consumers of +.Fn cap_enter +should also be aware of other inheritted rights, such as access to VM +resources, memory contents, and other process properties that should be +considered. +It is advisable to use +.Xr fexecve 2 +to create a runtime environment inside the sandbox that has as few implicitly +acquired rights as possible. +.Sh RETURN VALUES +.Rv -std cap_enter cap_getmode +.Sh SEE ALSO +.Xr cap_new 2 , +.Xr fexecve 2 , +.Xr libcapability 3 +.Sh HISTORY +Support for capabilities and capabilities mode was developed as part of the +.Tn TrustedBSD +Project. +.Sh BUGS +WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED ON IN +PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND UNEXPECTED WAYS. +.Sh AUTHORS +These functions and the capability facility were created by +.An "Robert N. M. Watson" +at the University of Cambridge Computer Laboratory with support from a grant +from Google, Inc. Added: projects/capabilities8/lib/libc/sys/cap_new.2 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ projects/capabilities8/lib/libc/sys/cap_new.2 Thu Oct 8 22:21:53 2009 (r197881) @@ -0,0 +1,481 @@ +.\" +.\" Copyright (c) 2008-2009 Robert N. M. Watson +.\" All rights reserved. +.\" +.\" WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED +.\" ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND +.\" UNEXPECTED WAYS. +.\" +.\" This software was developed at the University of Cambridge Computer +.\" Laboratory with support from a grant from Google, Inc. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd June 11, 2009 +.Dt CAP_NEW 2 +.Os +.Sh NAME +.Nm cap_new , +.Nm cap_getrights +.Nd System calls to manipulate capabilities +.Sh LIBRARY +.Lb libc +.Sh SYNOPSIS +.In sys/capability.h +.Ft int +.Fn cap_new "int fd" "cap_rights_t rights" +.Ft int +.Fn cap_getrights "int fd" "cap_rights_t *rightsp" +.Sh DESCRIPTION +Capabilities are special file descriptors derived from an existing file +descriptor, such as one returned by +.Xr fhopen 2 , +.Xr kqueue 2 , +.Xr mq_open 2 , +.Xr open 2 , +.Xr pipe 2 , +.Xr shm_open 2 , +.Xr socket 2 , +or +.Xr socketpair 2 , +but with a restricted set of permitted operations determined by a rights +mask set when the capability is created. +These restricted rights cannot be changed after the capability is created, +although further capabilities with yet more restricted rights may be created +from an existing capability. +In every other sense, a capability behaves in the same way as the file +descriptor it was created from. +.Pp +.Fn cap_new +creates a new capability for the existing file descriptor +.Fa fd , +and returns a file descriptor for it. +Operations on the capability will be limited to those permitted by +.Fa rights , +which is static for the lifetime of the capability. +If +.Fa fd +refers to an existing capability, then +.Fa rights +must be equal to or a subset of the rights on that capability. +As with +.Xr dup 2 +and +.Xr dup2 2 , +many properties are shared between the new capability and the existing file +descriptor, including open file flags, blocking disposition, and file offset. +Many applications will prefer to use the +.Xr cap_limitfd 3 +library call, part of +.Xr libcapability 3 , +as it offers a more convenient interface. +.Pp +.Fn cap_getrights +queries the rights associated with the capability referred to by file +descriptor +.Fa fd . +.Pp +These system calls, when combined with +.Xr cap_enter 2 , +may be used to construct process sandboxes with highly granular rights +assignment. +.Sh RIGHTS +The following rights may be specified in a new capability rights mask: +.Bl -tag -width CAP_EXTATTR_DELETE +.It Dv CAP_ACCEPT +Permit +.Xr accept 2 . +.It Dv CAP_ACL_CHECK +Permit checking of an ACL on a file descriptor; there is no cross-reference +for this system call. +.It Dv CAP_ACL_DELETE +Permit +.Xr acl_delete_fd_np 2 . +.It Dv CAP_ACL_GET +Permit +.Xr acl_get_fd 2 +and +.Xr acl_get_fd_np 2 . +.It Dv CAP_ACL_SET +Permit +.Xr acl_set_fd 2 +and +.Xr acl_set_fd_np 2 . +.It Dv CAP_BIND +Permit +.Xr bind 2 . +Note that sockets can also become bound implicitly as a result of +.Xr connect 2 +or +.Xr send 2 , +and that socket options set with +.Xr setsockopt 2 +may also affect binding behavior. +.It Dv CAP_CONNECT +Permit +.Xr connect 2 ; +also required for +.Xr sendto 2 +with a non-NULL destination address. +.It Dv CAP_EVENT +Permit +.Xr select 2 , +.Xr poll 2 , +and +.Xr kevent 2 +to be used in monitoring the file descriptor for events. +.It Dv CAP_FEXECVE +Permit +.Xr fexecve 2 ; +.Dv CAP_READ +will also be required. +.It Dv CAP_EXTATTR_DELETE +Permit +.Xr extattr_delete_fd 2 . +.It Dv CAP_EXTATTR_GET +Permit +.Xr extattr_get_fd 2 . +.It Dv CAP_EXTATTR_LIST +Permit +.Xr extattr_list_fd 2 . +.It Dv CAP_EXTATTR_SET +Permit +.Xr extattr_set_fd 2 . +.It Dv CAP_FCHDIR +Permit +.Xr fchdir 2 . +.It Dv CAP_FCHFLAGS +Permit +.Xr fchflags 2 . +.It Dv CAP_FCHMOD +Permit +.Xr fchmod 2 . +.It Dv CAP_FCHOWN +Permit +.Xr fchown 2 . +.It Dv CAP_FCNTL +Permit +.Xr fcntl 2 ; +be aware that this call provides indirect access to other operations, such as +.Xr flock 2 . +.It Dv CAP_FLOCK +Permit +.Xr flock 2 +and related calls. +.It Dv CAP_FPATHCONF +Permit +.Xr fpathconf 2 . +.It Dv CAP_FSCK +Permit UFS background-fsck operations on the descriptor. +.It Dv CAP_FSTAT +Permit +.Xr fstat 2 . +.It Dv CAP_FSTATFS +Permit +.Xr fstatfs 2 . +.It Dv CAP_FSYNC +Permit +.Xr aio_fsync 2 +and +.Xr fsync 2 . +.Pp +.It Dv CAP_FTRUNCATE +Permit +.Xr ftruncate 2 . +.It Dv CAP_FUTIMES +Permit +.Xr futimes 2 . +.It Dv CAP_GETPEERNAME +Permit +.Xr getpeername 2 . +.It Dv CAP_GETSOCKNAME +Permit +.Xr getsockname 2 . +.It Dv CAP_GETSOCKOPT +Permit +.Xr getsockopt 2 . +.It Dv CAP_IOCTL +Permit +.Xr ioctl 2 . +Be aware that this system call has enourmous scope, including potentially +global scope for some objects. +.It Dv CAP_KEVENT +Permit +.Xr kevent 2 ; +.Dv CAP_EVENT +may also be required on file descriptors to be monitored using +.Xr kevent 2 . +.It Dv CAP_LISTEN +Permit +.Xr listen 2 ; +not much use (generally) without +.Dv CAP_BIND . +.It Dv CAP_LOOKUP +Permit the file descriptor to be used as a starting directory for calls such +as +.Xr linkat 2 , +.Xr openat 2 , +and +.Xr unlinkat 2 . +Note that these calls are not available in capability mode as they manipulate +a global name space; see +.Xr cap_enter 2 +for details. +.It Dv CAP_MAC_GET +Permit +.Xr mac_get_fd 2 . +.It Dv CAP_MAC_SET +Permit +.Xr mac_set_fd 2 . +.It Dv CAP_MMAP +Permit +.Xr mmap 2 ; +specific invocations may also require +.Dv CAP_READ +or +.Dv CAP_WRITE . +.Pp +.It Dv CAP_PDGETPID +Permit +.Xr pdgetpid 2 . +.It Dv CAP_PDKILL +Permit +.Xr pdkill 2 . +.It Dv CAP_PDWAIT +Permit +.Xr pdwait 2 . +.It Dv CAP_PEELOFF +Permit +.Xr sctp_peeloff 2 . +.It Dv CAP_READ +Allow +.Xr aio_read 2 , +.Xr pread 2 , +.Xr read 2 , +.Xr recv 2 , +.Xr recvfrom 2 , +.Xr recvmsg 2 , +and related system calls. +.Pp +For files and other seekable objects, +.Dv CAP_SEEK +may also be required. +.It Dv CAP_REVOKE +Permit +.Xr frevoke 2 +in certain ABI compatibility modes that support this system call. +.It Dv CAP_SEEK +Permit operations that seek on the file descriptor, such as +.Xr lseek 2 , +but also required for I/O system calls that modify the file offset, such as +.Xr read 2 +and +.Xr write 2 . +.It Dv CAP_SEM_GETVALUE +Permit +.Xr sem_getvalue 3 . +.It Dv CAP_SEM_POST +Permit +.Xr sem_post 3 . +.It Dv CAP_SEM_WAIT +Permit +.Xr sem_wait 3 +and +.Xr sem_trywait 3 . +.It Dv CAP_SETSOCKOPT +Permit +.Xr setsockopt 2 ; +this controls various aspects of socket behavior and may affect binding, +connecting, and other behaviors with global scope. +.It Dv CAP_SHUTDOWN +Permit explicit +.Xr shutdown 2 ; +closing the socket will also generally shut down any connections on it. +.It Dv CAP_TTYHOOK +Allow configuration of TTY hooks, such as +.Xr snp 4 , +on the file descriptor. +.It Dv CAP_WRITE +Allow +.Xr aio_write 2 , +.Xr pwrite 2 , +.Xr send 2 , +.Xr sendmsg 2 , +.Xr sendto 2 , +.Xr write 2 , +and related system calls. +.Pp +For files and other seekable objects, +.Dv CAP_SEEK +may also be required. +.Pp +For +.Xr sendto 2 +with a non-NULL connection address, +.Dv CAP_CONNECT +is also required. +.El +.Sh CAVEAT +The +.Fn cap_new +system call and the capabilities it creates may be used to assign +fine-grained rights to sandboxed processes running in capability mode. +However, the semantics of objects accessed via file descriptors are complex, +so caution should be exercised in passing object capabilities into sandboxes. +.Sh RETURN VALUES +If successful, +.Fn cap_new +returns a non-negative integer, termed a file descriptor. +It returns -1 on failure, and sets +.Va errno +to indicate the error. +.Pp +.Rv -std cap_getrights +.Sh ERRORS +.Fn cap_new +may return the following errors: +.Bl -tag -width Er +.It Bq Er EBADF +The +.Fa fd +argument is not a valid active descriptor. +.It Bq Er EINVAL +An invalid right has been requested in +.Fa rights . +.It Bq Er EMFILE +The process has already reached its limit for open file descriptors. +.It Bq Er ENFILE +The system file table is full. +.It Bq Er EPERM +.Fa rights +contains requested rights not present in the current rights mask associated +with the capability referenced by +.Fa fd , +if any. +.El +.Pp +.Fn cap_getrights +may return the following errors: +.Bl -tag -width Er +.It Bq Er EBADF +The +.Fa fd +argument is not a valid active descriptor. +.It Bq Er EINVAL +The +.Fa fd +argument is not a capability. +.El +.Sh SEE ALSO +.Xr accept 2 , +.Xr acl_delete_fd_np 2 , +.Xr acl_get_fd 2 , +.Xr acl_get_fd_np 2 , +.Xr acl_set_fd_np 2 , +.Xr aio_read 2 , +.Xr aio_fsync 2 , +.Xr aio_write 2 , +.Xr bind 2 , +.Xr cap_enter 2 , +.Xr connect 2 , +.Xr dup 2 , +.Xr dup2 2 , +.Xr extattr_delete_fd 2 , +.Xr extattr_get_fd 2 , +.Xr extattr_list_fd 2 , +.Xr extattr_set_fd 2 , +.Xr fchflags 2 , +.Xr fchown 2 , +.Xr fcntl 2 , +.Xr fexecve 2 , +.Xr fhopen 2 , +.Xr flock 2 , +.Xr fpathconf 2 , +.Xr fstat 2 , +.Xr fstatfs 2 , +.Xr fsync 2 , +.Xr ftruncate 2 , +.Xr futimes 2 , +.Xr getpeername 2 , +.Xr getsockname 2 , +.Xr getsockopt 2 , +.Xr ioctl 2 , +.Xr kevent 2 , +.Xr kqueue 2 , +.Xr linkat 2 , +.Xr listen 2 , +.Xr mac_get_fd 2 , +.Xr mac_set_fd 2 , +.Xr mmap 2 , +.Xr mq_open 2 , +.Xr open 2 , +.Xr openat 2 , +.Xr pdgetpid 2 , +.Xr pdkill 2 , +.Xr pdwait 2 , +.Xr pipe 2 , +.Xr poll 2 , +.Xr pread 2 , +.Xr pwrite 2 , +.Xr read 2 , +.Xr recv 2 , +.Xr recvfrom 2 , +.Xr recvmsg 2 , +.Xr sctp_peeloff 2 , +.Xr select 2 , +.Xr send 2 , +.Xr sendmsg 2 , +.Xr sendto 2 , +.Xr setsockopt 2 , +.Xr shm_open 2 , +.Xr shutdown 2 , +.Xr socket 2 , +.Xr socketpair 2 , +.Xr unlinkat 2 , +.Xr write 2 , +.Xr cap_limitfd 3 , +.Xr libcapability 3 , +.Xr sem_getvalue 3 , +.Xr sem_post 3 , +.Xr sem_trywait 3 , +.Xr sem_wait 3 , +.Xr snp 4 +.Sh HISTORY +Support for capabilities and capabilities mode was developed as part of the +.Tn TrustedBSD +Project. +.Sh BUGS +This man page should list the set of permitted system calls more specifically +for each capability right. +.Pp +Capability rights sometimes have unclear indirect impacts, which should be +documented, or at least hinted at. +.Pp +WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED ON IN +PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND UNEXPECTED WAYS. +.Sh AUTHORS +These functions and the capability facility were created by +.An "Robert N. M. Watson" +at the University of Cambridge Computer Laboratory with support from a grant +from Google, Inc. Modified: projects/capabilities8/lib/libc/sys/fork.2 ============================================================================== --- projects/capabilities8/lib/libc/sys/fork.2 Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/lib/libc/sys/fork.2 Thu Oct 8 22:21:53 2009 (r197881) @@ -122,6 +122,7 @@ There is insufficient swap space for the .El .Sh SEE ALSO .Xr execve 2 , +.Xr pdfork 2 , .Xr rfork 2 , .Xr setitimer 2 , .Xr setrlimit 2 , Modified: projects/capabilities8/lib/libc/sys/intro.2 ============================================================================== --- projects/capabilities8/lib/libc/sys/intro.2 Thu Oct 8 21:53:58 2009 (r197880) +++ projects/capabilities8/lib/libc/sys/intro.2 Thu Oct 8 22:21:53 2009 (r197881) @@ -456,6 +456,9 @@ The specified extended attribute does no .It Er 88 EDOOFUS Em "Programming error" . A function or API is being abused in a way which could only be detected at run-time. +.It Er 93 ENOTCAPABLE Em "Capabilities insufficient" . +An operation on a capability file descriptor requires greater privilege than +the capability allows. .El .Sh DEFINITIONS .Bl -tag -width Ds Added: projects/capabilities8/lib/libc/sys/pdfork.2 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ projects/capabilities8/lib/libc/sys/pdfork.2 Thu Oct 8 22:21:53 2009 (r197881) @@ -0,0 +1,123 @@ +.\" +.\" Copyright (c) 2009 Robert N. M. Watson +.\" All rights reserved. +.\" +.\" WARNING: THIS IS EXPERIMENTAL SECURITY SOFTWARE THAT MUST NOT BE RELIED +.\" ON IN PRODUCTION SYSTEMS. IT WILL BREAK YOUR SOFTWARE IN NEW AND +.\" UNEXPECTED WAYS. +.\" +.\" This software was developed at the University of Cambridge Computer +.\" Laboratory with support from a grant from Google, Inc. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd January 18, 2009 +.Dt PDFORK 2 +.Os +.Sh NAME +.Nm pdfork , +.Nm pdgetpid , +.Nm pdkill , +.Nm pdwait +.Nd System calls to manage process descriptors +.Sh LIBRARY +.Lb libc +.Sh SYNOPSIS +.In sys/procdesc.h +.Ft int +.Fn pdfork "int *fdp" +.Ft int +.Fn pdgetpid "int fd" "pid_t *pidp" +.Ft int +.Fn pdkill "int fd" "int signum" +.Ft int +.Fn pdwait "int fd" "int *status" "int options" "struct rusage *rusage" +.Sh DESCRIPTION +Process descriptors are special file descriptors that represent processes, +and are created using +.Fn pdfork , +a variant of +.Xr fork 2 , +which, if successful, returns a process descriptor in the integer pointed to +by +.Fa pidp . +.Pp +.Fn pdgetpid +queries the process ID (PID) if the process descriptor +.Fa fd . +.Pp +.Fn pdkill +is functionally identical to +.Xr kill 2 , +except that it accepts a process descriptor, +.Fa fd , +rather than a PID. +.Pp +.Fn pdwait +is currently unimplemented, but in the future will be functionally identical +to +.Xr wait4 2 , +except that it accepts a process descriptor rather than a PID. +.Pp +The following system calls also have effects specific to process descriptors: +.Pp +.Xr fstat 2 +queries status of a process descriptor; currently only the +.Fa sb_mode +field is defined; if the owner read, write, and execute bits are set then the +process represented by the process descriptor is still alive. +.Pp +.Xr poll 2 +allows waiting for process state transitions; currently only +.Dv POLLHUP +is defined, and will be raised when the process dies. +.Pp +.Xr close 2 +will close the process descriptor, and if the process is still alive, +terminate it with the signal +.Dv SIGKILL . +.Sh RETURN VALUES +.Sh ERRORS +.Sh SEE ALSO +.Xr close 2 , +.Xr fork 2 , +.Xr fstat 2 , +.Xr kill 2 , +.Xr poll 2 , +.Xr wait4 2 +.Sh HISTORY +Support for process descriptors mode was developed as part of the +.Tn TrustedBSD +Project. +.Sh BUGS +.Fn pdwait *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***