d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cap_enter(2): fix CAVEATS section

Browse Source 
The CAVEATS section was misspelled as "CAVEAT" before this change. Fix the
spelling to identify issues related to the section.

Furthermore, given that the section order was incorrect, move the CAVEATS
section down to the bottom of the manpage, per the conventional section
order.

MFC after:	1 week
Reported by:	make manlint
Sponsored by:	DellEMC Isilon
This commit is contained in:
Enji Cooper 2020-12-11 00:26:49 +00:00
parent 2c96ea9ca0
commit 20daf0ca6e
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=368536
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
lib/libc/sys/cap_enter.2
View File

@ -97,19 +97,6 @@ and
operations of the
.Xr procctl 2
function for similar per-process functionality.
.Sh CAVEAT
Creating effective process sandboxes is a tricky process that involves
identifying the least possible rights required by the process and then
passing those rights into the process in a safe manner.
Consumers of
.Fn cap_enter
should also be aware of other inherited rights, such as access to VM
resources, memory contents, and other process properties that should be
considered.
It is advisable to use
.Xr fexecve 2
to create a runtime environment inside the sandbox that has as few implicitly
acquired rights as possible.
.Sh RETURN VALUES
.Rv -std cap_enter cap_getmode
.Pp
@ -162,3 +149,16 @@ These functions and the capability facility were created by
.An "Robert N. M. Watson"
at the University of Cambridge Computer Laboratory with support from a grant
from Google, Inc.
.Sh CAVEATS
Creating effective process sandboxes is a tricky process that involves
identifying the least possible rights required by the process and then
passing those rights into the process in a safe manner.
Consumers of
.Fn cap_enter
should also be aware of other inherited rights, such as access to VM
resources, memory contents, and other process properties that should be
considered.
It is advisable to use
.Xr fexecve 2
to create a runtime environment inside the sandbox that has as few implicitly
acquired rights as possible.