d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libcapsicum: Introduce caph_{rights,ioctls,fcntls}_limit

Browse Source 
The idea behind those functions is not to force consumers to remember that there
is a need to check errno on failure. We already have a caph_enter(3) function
which does the same for cap_enter(2).

MFC after:	2 weeks
This commit is contained in:
Mariusz Zaborski 2018-11-04 17:22:58 +00:00
parent 82560231d3
commit 5a453d5f5b
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=340130
3 changed files with 54 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib/libcapsicum/Makefile
View File

@ -8,6 +8,7 @@ MAN+= capsicum_helpers.3
MLINKS+=capsicum_helpers.3 caph_enter.3 MLINKS+=capsicum_helpers.3 caph_enter.3
MLINKS+=capsicum_helpers.3 caph_enter_casper.3 MLINKS+=capsicum_helpers.3 caph_enter_casper.3
MLINKS+=capsicum_helpers.3 caph_rights_limit.3
MLINKS+=capsicum_helpers.3 caph_limit_stream.3 MLINKS+=capsicum_helpers.3 caph_limit_stream.3
MLINKS+=capsicum_helpers.3 caph_limit_stdin.3 MLINKS+=capsicum_helpers.3 caph_limit_stdin.3
MLINKS+=capsicum_helpers.3 caph_limit_stderr.3 MLINKS+=capsicum_helpers.3 caph_limit_stderr.3

30
lib/libcapsicum/capsicum_helpers.3
View File

@ -24,7 +24,7 @@
.\" .\"
.\" $FreeBSD$ .\" $FreeBSD$
.\" .\"
.Dd July 18, 2018 .Dd November 4, 2018
.Dt CAPSICUM_HELPERS 3 .Dt CAPSICUM_HELPERS 3
.Os .Os
.Sh NAME .Sh NAME
@ -34,7 +34,12 @@
.Nm caph_limit_stdout , .Nm caph_limit_stdout ,
.Nm caph_limit_stdio , .Nm caph_limit_stdio ,
.Nm caph_cache_tzdata , .Nm caph_cache_tzdata ,
.Nm caph_cache_catpages .Nm caph_cache_catpages ,
.Nm caph_enter ,
.Nm caph_enter_casper ,
.Nm caph_rights_limit ,
.Nm caph_ioctls_limit ,
.Nm caph_fcntls_limit
.Nd "set of the capsicum helpers, part of the libcapsicum" .Nd "set of the capsicum helpers, part of the libcapsicum"
.Sh LIBRARY .Sh LIBRARY
.Lb libcapsicum .Lb libcapsicum
@ -45,7 +50,11 @@
.Ft int .Ft int
.Fn caph_enter_casper "void" .Fn caph_enter_casper "void"
.Ft int .Ft int
.Fn caph_limit_stream "int fd" "int flags" .Fn caph_rights_limit "inf fd" "const cap_righst_t *rights"
.Ft int
.Fn caph_ioctls_limit "inf fd" "const unsigned long *cmds" "size_t ncmds"
.Ft int
.Fn caph_fcntls_limit "inf fd" "uint32_t fcntlrights"
.Ft int .Ft int
.Fn caph_limit_stdin "void" .Fn caph_limit_stdin "void"
.Ft int .Ft int
@ -60,9 +69,17 @@
.Fn caph_cache_catpages "void" .Fn caph_cache_catpages "void"
.Sh DESCRIPTION .Sh DESCRIPTION
The The
.Nm caph_enter .Nm caph_enter ,
is equivalent to the .Nm caph_rights_limit ,
.Xr cap_enter 2 .Nm caph_ioctls_limit
and
.Nm caph_fcntls_limit
are respectively equivalent to
.Xr cap_enter 2 ,
.Xr cap_rights_limit 2 ,
.Xr cap_ioctls_limit 2
and
.Xr cap_fcntls_limit 2 ,
it returns success when the kernel is built without support of the capability it returns success when the kernel is built without support of the capability
mode. mode.
.Pp .Pp
@ -125,4 +142,5 @@ among others.
.Ed .Ed
.Sh SEE ALSO .Sh SEE ALSO
.Xr cap_enter 2 , .Xr cap_enter 2 ,
.Xr cap_rights_limit 2 ,
.Xr rights 4 .Xr rights 4

29
lib/libcapsicum/capsicum_helpers.h
View File

@ -136,6 +136,35 @@ caph_enter(void)
return (0); return (0);
} }
static __inline int
caph_rights_limit(int fd, const cap_rights_t *rights)
{
if (cap_rights_limit(fd, rights) < 0 && errno != ENOSYS)
return (-1);
return (0);
}
static __inline int
caph_ioctls_limit(int fd, const unsigned long *cmds, size_t ncmds)
{
if (cap_ioctls_limit(fd, cmds, ncmds) < 0 && errno != ENOSYS)
return (-1);
return (0);
}
static __inline int
caph_fcntls_limit(int fd, uint32_t fcntlrights)
{
if (caph_fcntls_limit(fd, fcntlrights) < 0 && errno != ENOSYS)
return (-1);
return (0);
}
static __inline int static __inline int
caph_enter_casper(void) caph_enter_casper(void)