Commit Graph

90 Commits

Author SHA1 Message Date
Mariusz Zaborski
28f4385e45 libcasper: do not run registered exit functions
Casper library should not use exit(3) function because before setting it up
applications may register it. Casper doesn't depend on any registered exit
function, so it safe to change this.

Reported by:	jceel
MFC after:	2 weeks
2019-01-26 14:10:49 +00:00
Mark Johnston
08c4a937a6 Let the cap_syslog capability inherit stdio descriptors.
Otherwise cap_openlog(LOG_PERROR) doesn't work.

Reviewed by:	oshogbo
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D18457
2018-12-07 15:52:50 +00:00
Mariusz Zaborski
77ebcc05ea libcasper: do not fail if Capsicum is not avilable
Casper service can be also used on the kernels without Capsicum support.

Reported by:	sbruno
Tested by:	sbruno
2018-11-30 19:27:14 +00:00
Mariusz Zaborski
2863fd2f27 libcasper: provide compatibility with the old version of service
Some external tools like tcpdump(1) have upstream the changes with old limits
name. Because of that provide compatibility with the old names.

Reported by:	emaste
2018-11-19 17:22:52 +00:00
Mariusz Zaborski
fd253945ac Update the names in the LIMITS and EXAMPLES sections after r340363.
Reported by:	markj
2018-11-18 11:11:27 +00:00
Mariusz Zaborski
2607c01b66 Fix typo in the comparison.
This fix build with gcc.

Reported by:	jenkins
2018-11-12 18:37:31 +00:00
Mariusz Zaborski
cdd6ea94b0 libcasper: introduce cap_fileargs service
cap_fileargs is a Casper service which helps to sandbox applications that need
access to the filesystem namespace. The main purpose of the service is to make
easy to capsicumize applications that works on multiple files passed in argv.

We have a couple example of using it but we still treat this service as an
experimental one.

Reviewed by:	emsate (previous version), jonathan (partially)
Discussed with:	many
Differential Revision:	https://reviews.freebsd.org/D14407
2018-11-12 17:40:47 +00:00
Mariusz Zaborski
752d135e0d libcasper: ange the name of limits in cap_dns so the intentions are obvious.
Reported by:	pjd
MFC after:	3 weeks
2018-11-12 15:52:45 +00:00
Mark Johnston
35b4d0f125 Document the fact that cap_limit_set() always frees the input nvlist.
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2018-11-05 21:01:45 +00:00
Mariusz Zaborski
d9c2248dd5 libcasper: using explicit_bzero in cap_grp service
Please notice that we still don't clean information in nvlist structures.

Submitted by:	David CARLIER <devnexen@gmail.com>
Differential Revision:	https://reviews.freebsd.org/D16777
2018-11-04 19:43:59 +00:00
Mariusz Zaborski
577dff6a8d libcasper: fix limitations in dns service
The getaddrinfo(3) and gethostbyname(3) are used to return the address for a
given hostname. The getnameinfo(3) and gethostbyaddr(3) are used to return
hostname for a given address. Right now in casper, we have two limitations:
- NAME which allows resolving DNS names.
- ADDR which allows to do revert DNS lookups.

Before this change the rights was mixed up:
NAME - getnameinfo(3) and gethostbyname(3)
ADDR - gethostbyaddr(3) and getaddrinfo(3)

Which no matters on limitation allowed us to resolve DNS names and do DNS
lookups basically by using a different set of functions.

Now the NAME type allows getaddrinfo(3) and gethostbyname (3)functions,
and the ADDR names allow to use gethostbyaddr(3) and getnameinfo(3) functions.

Reviewed by:	pjd, bcr
MFC after:	3 weeks
Discussed with:	hrs
Differential Revision:	https://reviews.freebsd.org/D16930
2018-11-04 19:38:54 +00:00
Mariusz Zaborski
db9a6e4178 libcasper: Update example in man page to use cap_getnameinfo function.
Reviewed by:	hrs
Differential Revision:	https://reviews.freebsd.org/D16931
2018-11-04 19:31:44 +00:00
Mariusz Zaborski
fe24949034 libcasper: Document the cap_getaddrinfo and cap_getnameinfo functions
Reviewed by:	hrs
Differential Revision:	https://reviews.freebsd.org/D16929
2018-11-04 19:29:19 +00:00
Mark Johnston
e9b1dc32c9 Fix comments.
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2018-10-24 00:17:19 +00:00
Edward Tomasz Napierala
78b9f0095b Fix typo.
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
2018-08-16 14:46:49 +00:00
Mariusz Zaborski
2da0fcde21 With r335636 C++ program use libcasper.h and capsicum_helpers.h.
Add __BEGIN_DECLS and __END_DECLS to those headers.
2018-07-01 18:58:53 +00:00
Mariusz Zaborski
00e9473388 [libcasper] Use explicit_bzero instead of memset to clear pwd struct
Submitted by:	David Carlier <devnexen@gmail.com>
Differential Revision:	https://reviews.freebsd.org/D16015
2018-06-26 19:57:47 +00:00
Eitan Adler
bec6dc30e1 users(1): Use capsicum helpers for users
In doing so also fix the libcasper.h header to work in C++.
2018-06-25 11:44:41 +00:00
Mariusz Zaborski
9324388b0a Document libcasper_service.
Reviewed by:	bcr@
Differential Revision:	https://reviews.freebsd.org/D15766
2018-06-23 20:12:30 +00:00
Mariusz Zaborski
68b2ec19e1 Fix typo. 2018-06-19 22:19:42 +00:00
Mariusz Zaborski
4468cd1a73 The gids argument can be declared as const.
We don't modified it in this function.
2018-03-18 19:50:32 +00:00
Mariusz Zaborski
78d69bcbf4 Fix reference to man page in Makefile.
I broke it in r331120.
2018-03-18 17:27:37 +00:00
Mariusz Zaborski
cba559e112 Fix similar typos to r331124. 2018-03-18 16:06:35 +00:00
Mariusz Zaborski
d5219c1955 Fix typo.
Submitted by:	Trond Endrestøl <Trond.Endrestol@ximalas.info>
2018-03-18 16:02:41 +00:00
Mariusz Zaborski
2d649033ec Update libcasper references to all new man pages.
Remove obsolete example. All services has they own example.
This example also show old type of limiting method which is
not recommended to use.

Reviewed by:	bcr@
Differential Revision:	https://reviews.freebsd.org/D14607
2018-03-18 15:24:45 +00:00
Mariusz Zaborski
edd09a2599 Document the sysctl Casper service.
PR:		226102
Reviewed by:	bcr@
Differential Revision:	https://reviews.freebsd.org/D14606
2018-03-18 15:16:47 +00:00
Mariusz Zaborski
54442b3cfa Document the pwd Casper service.
PR:		226102
Reviewed by:	bcr@
Differential Revision:	https://reviews.freebsd.org/D14605
2018-03-18 15:13:37 +00:00
Mariusz Zaborski
85ebe1f1cf nv was moved to the 9 section.
Fix reference to it.
2018-02-26 19:08:27 +00:00
Mariusz Zaborski
8763ae3526 Fix typo. 2018-02-26 18:06:15 +00:00
Mariusz Zaborski
a241c14f9a Fix reference to nvlist in man pages.
Reviewed by:	@bcr @brueffer
Pointed out by:	@brueffer
Differential Revision:	https://reviews.freebsd.org/D14410
2018-02-24 16:31:26 +00:00
Mariusz Zaborski
4fc0a2791e Introduce channel flags in libcasper.
Instead of passing flags (which describe a type of nvlist)
every send/recv we remember them in channel.
It's enough for use to extract them only during unwrap.
This simplify use of Casper.

Reviewed by:	bruffer@, bcr@ (both man page)
Differential Revision:	https://reviews.freebsd.org/D14196 (man page)
2018-02-17 12:22:29 +00:00
Mark Johnston
c0a2a830e2 Document the need for WITH_CASPER.
After r325062, consumers need to define WITH_CASPER for libcasper to
function as expected.
2018-02-05 17:33:16 +00:00
Mariusz Zaborski
5869a5d8ea The name of the library is exactly the same like one of name the name of the
functions.

We should not create MLINKS for that one, because it's break a build.

Submitted by:	lwhsu@
2018-01-29 05:29:28 +00:00
Mariusz Zaborski
eca3793736 Document the syslog Casper service.
Reviewed by:	bcr@
Differential Revision:	https://reviews.freebsd.org/D14084
2018-01-29 04:38:11 +00:00
Mariusz Zaborski
c1d2583d9d Add cap_random.3 to build system.
This should be done with r328494.
2018-01-27 22:57:06 +00:00
Mariusz Zaborski
90b809116a Fix caspermock - the cap_recv_nvlist should return nvlist. 2018-01-27 22:53:29 +00:00
Mariusz Zaborski
f45de90e55 Document the random Casper service.
Reviewed by:	bcr@
Differential Revision:	https://reviews.freebsd.org/D14072
2018-01-27 22:49:34 +00:00
Mariusz Zaborski
28b6f7c86a Add SPDX tags for libcasper(3) and services.
MFC after:	2 weeks
2018-01-27 12:55:34 +00:00
Mariusz Zaborski
56a791046d Document the grp Casper service.
Reviewed by:	brueffer@, bcr@
Differential Revision:	https://reviews.freebsd.org/D13821
2018-01-27 11:54:51 +00:00
Mariusz Zaborski
280f3264a4 Fix markup. 2018-01-10 02:57:22 +00:00
Mariusz Zaborski
d06b4cefed Document the DNS Casper service.
Reviewed by:	brueffer@, bcr@
Differential Revision:	https://reviews.freebsd.org/D13762
2018-01-08 09:20:08 +00:00
Mariusz Zaborski
e1c30f7a07 Build service tests with Casper support. 2018-01-05 09:31:41 +00:00
Mariusz Zaborski
40905ec6bb cap_unwrap should return a descriptor but also free the structure. 2018-01-04 08:23:23 +00:00
Mariusz Zaborski
bf2204a5ef Add missing macro in man page.
Reported by:	brueffer@
2018-01-04 04:04:29 +00:00
Mariusz Zaborski
6564c8d6ca Document services which we have in libcasper.
Reviewed by:	bcr@
Differential Revision:	https://reviews.freebsd.org/D13734
2018-01-03 06:22:40 +00:00
Mariusz Zaborski
7b4fce76cc Introduce syslog service for Casper.
syslog in libc secretly reconnects to the daemon.
Another issue is that we don't have any information from openlog(3) if we
succeeded to open log or not so we don't know if we are ready
to enter cabability mode.
Because all of that we decided we need a syslog service for Caspser.

Reviewed by:	bapt@
Differential Revision:	https://reviews.freebsd.org/D12824
2017-11-12 08:34:25 +00:00
Mariusz Zaborski
8751b03b19 We return a pointer when we are using cap_init() or cap_service_open()
function, so check if cap_chanel_t is NULL is not enough.
Casper with a normal libc will still fail in capability mote so let's not
enter capability mode without casper support when we need to resolve DNS.

Reviewed by:	cem
Differential Revision:	https://reviews.freebsd.org/D12823
2017-11-12 07:18:10 +00:00
Glen Barber
0ff7d32714 Fix the 'casper' package, following r325062.
Submitted by:	woodsb02
Sponsored by:	The FreeBSD Foundation
2017-11-08 01:00:59 +00:00
Mariusz Zaborski
0dfac7ee08 The src.opts.mk sets default value for the SHLIBDIR, so our set was not
respected.

Please notice that libcasper is already in ObsoleteFiles so we don't add it
again.

Reported by:	Herbert J. Skuhra <herbert@mailbox.org>
Reviewed by:	bdrewery@
Differential Revision:	https://reviews.freebsd.org/D12918
2017-11-04 15:50:05 +00:00
Mariusz Zaborski
95844abe53 Casper work's only as shared library - disable building static ones.
Reviewed by:	bdrewery@
Differential Revision:	https://reviews.freebsd.org/D12917
2017-11-04 15:47:18 +00:00