Commit Graph

36 Commits

Author SHA1 Message Date
Robert Watson
b881b8be1d Update most userspace consumers of capability.h to use capsicum.h instead.
auditdistd is not updated as I will make the change upstream and then do a
vendor import sometime in the next week or two.

MFC after:	3 weeks
2014-03-16 11:04:44 +00:00
Pawel Jakub Dawidek
7008be5bd7 Change the cap_rights_t type from uint64_t to a structure that we can extend
in the future in a backward compatible (API and ABI) way.

The cap_rights_t represents capability rights. We used to use one bit to
represent one right, but we are running out of spare bits. Currently the new
structure provides place for 114 rights (so 50 more than the previous
cap_rights_t), but it is possible to grow the structure to hold at least 285
rights, although we can make it even larger if 285 rights won't be enough.

The structure definition looks like this:

	struct cap_rights {
		uint64_t	cr_rights[CAP_RIGHTS_VERSION + 2];
	};

The initial CAP_RIGHTS_VERSION is 0.

The top two bits in the first element of the cr_rights[] array contain total
number of elements in the array - 2. This means if those two bits are equal to
0, we have 2 array elements.

The top two bits in all remaining array elements should be 0.
The next five bits in all array elements contain array index. Only one bit is
used and bit position in this five-bits range defines array index. This means
there can be at most five array elements in the future.

To define new right the CAPRIGHT() macro must be used. The macro takes two
arguments - an array index and a bit to set, eg.

	#define	CAP_PDKILL	CAPRIGHT(1, 0x0000000000000800ULL)

We still support aliases that combine few rights, but the rights have to belong
to the same array element, eg:

	#define	CAP_LOOKUP	CAPRIGHT(0, 0x0000000000000400ULL)
	#define	CAP_FCHMOD	CAPRIGHT(0, 0x0000000000002000ULL)

	#define	CAP_FCHMODAT	(CAP_FCHMOD | CAP_LOOKUP)

There is new API to manage the new cap_rights_t structure:

	cap_rights_t *cap_rights_init(cap_rights_t *rights, ...);
	void cap_rights_set(cap_rights_t *rights, ...);
	void cap_rights_clear(cap_rights_t *rights, ...);
	bool cap_rights_is_set(const cap_rights_t *rights, ...);

	bool cap_rights_is_valid(const cap_rights_t *rights);
	void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
	void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
	bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);

Capability rights to the cap_rights_init(), cap_rights_set(),
cap_rights_clear() and cap_rights_is_set() functions are provided by
separating them with commas, eg:

	cap_rights_t rights;

	cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT);

There is no need to terminate the list of rights, as those functions are
actually macros that take care of the termination, eg:

	#define	cap_rights_set(rights, ...)				\
		__cap_rights_set((rights), __VA_ARGS__, 0ULL)
	void __cap_rights_set(cap_rights_t *rights, ...);

Thanks to using one bit as an array index we can assert in those functions that
there are no two rights belonging to different array elements provided
together. For example this is illegal and will be detected, because CAP_LOOKUP
belongs to element 0 and CAP_PDKILL to element 1:

	cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL);

Providing several rights that belongs to the same array's element this way is
correct, but is not advised. It should only be used for aliases definition.

This commit also breaks compatibility with some existing Capsicum system calls,
but I see no other way to do that. This should be fine as Capsicum is still
experimental and this change is not going to 9.x.

Sponsored by:	The FreeBSD Foundation
2013-09-05 00:09:56 +00:00
Pawel Jakub Dawidek
d7499324a8 Few more style nits.
MFC after:	1 month
2013-07-03 20:44:47 +00:00
Pawel Jakub Dawidek
7c33a30a7a Sandbox rwho(1) using capability mode and Capsicum capabilities.
rwho(1) gets only read-only access to /var/rwho/ directory.

Submitted by:	Mariusz Zaborski <oshogbo@FreeBSD.org>
Sponsored by:	Google Summer of Code 2013
Reviewed by:	pjd
MFC after:	1 month
2013-07-03 20:42:10 +00:00
Pawel Jakub Dawidek
c05bfdd395 Style cleanups.
Submitted by:	Mariusz Zaborski <oshogbo@FreeBSD.org>
Sponsored by:	Google Summer of Code 2013
Reviewed by:	pjd
MFC after:	1 month
2013-07-03 20:28:33 +00:00
Ed Schouten
af397f37ab Add missing static keywords to rwho(1) 2011-11-06 08:16:59 +00:00
Ed Schouten
c75216d258 Build rwho(1) with WARNS=6.
The only reason why it didn't build with WARNS=6, is because of some
simple to fix string formatting bugs.

MFC after:	3 months
2011-10-16 08:54:41 +00:00
Joel Dahl
da52b4caaf Remove the advertising clause from UCB copyrighted files in usr.bin. This
is in accordance with the information provided at
ftp://ftp.cs.berkeley.edu/pub/4bsd/README.Impt.License.Change

Also add $FreeBSD$ to a few files to keep svn happy.

Discussed with:	imp, rwatson
2010-12-11 08:32:16 +00:00
Ed Schouten
b7946da96b Build usr.bin/ with WARNS=6 by default.
Also add some missing $FreeBSD$ to keep svn happy.
2010-01-02 10:27:05 +00:00
Ed Schouten
b1625b09d9 Let the width of the username column depend on the rwho file format.
Right now the code uses UT_NAMESIZE, but this makes little sense,
because rwho(1) parses files generated by rwhod(8). Not utmp(5) files.
2009-12-25 20:07:48 +00:00
Suleiman Souhlal
639d7cbad1 It's actually 11 minutes when the machine is assumed to be down and removed
from the output.

Obtained from:	DragonFlyBSD
2005-08-07 11:48:44 +00:00
Ruslan Ermilov
0227791b40 Expand *n't contractions. 2005-02-13 22:25:33 +00:00
Mark Murray
301777f2d2 Modernise; ISOify, use __FBSDID(), use headers instead of hand-declaring.
Fix easy warnings.
2002-07-01 16:40:33 +00:00
Warner Losh
d3cb5ded92 remove __P 2002-03-22 01:33:25 +00:00
Matthew Dillon
170ac683f2 I've been meaning to do this for a while. Add an underscore to the
time_to_xxx() and xxx_to_time() functions.  e.g. _time_to_xxx()
instead of time_to_xxx(), to make it more obvious that these are
stopgap functions & placemarkers and not meant to create a defacto
standard.  They will eventually be replaced when a real standard
comes out of committee.
2002-01-19 23:20:02 +00:00
Matthew Dillon
46ca39e2ba Fix time_t == int assumption, convert protocol int to time_t. 2001-10-28 20:26:54 +00:00
Ruslan Ermilov
625003720a mdoc(7) police: removed HISTORY info from the .Os call. 2001-07-10 14:16:33 +00:00
Andrey A. Chernov
3bd65123fa Don't attempt to parse %c 2001-03-21 20:26:51 +00:00
Philippe Charnier
11458b9601 Get rid of hard sentence break
Asked by: Sheldon
2000-03-27 20:38:21 +00:00
Philippe Charnier
115a32af83 Add section number to .Xr references. Enumerate flags the standard way. 2000-03-26 14:54:01 +00:00
Peter Wemm
c3aac50f28 $Id$ -> $FreeBSD$ 1999-08-28 01:08:13 +00:00
Nik Clayton
3be5f1f5ce Add $Id$, to make it simpler for members of the translation teams to
track.

The $Id$ line is normally at the bottom of the main comment block in the
man page, separated from the rest of the manpage by an empty comment,
like so;

     .\"    $Id$
     .\"

If the immediately preceding comment is a @(#) format ID marker than the
the $Id$ will line up underneath it with no intervening blank lines.
Otherwise, an additional blank line is inserted.

Approved by:            bde
1999-07-12 20:24:20 +00:00
Foxfair Hu
8e1c603056 Fixed typo. 1998-12-20 02:52:30 +00:00
Steve Price
e1f4275a7c Be picky about the format of the commandline and cleanup
a warning related to qsort.

PR:		6420
Submitted by:	Ruslan Ermilov <ru@ucb.crimea.ua>
1998-05-03 23:22:37 +00:00
Philippe Charnier
157f1c6c00 Use err(3). Add usage() and prototypes. Add Xr to who(1). 1997-08-08 12:20:24 +00:00
Warner Losh
1c8af87873 compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.
1997-03-29 04:34:07 +00:00
Andrey A. Chernov
7618cd1238 Fix my error from previous commit with mixing rwhod protocol
and utmp sizes.
Replace hardcoded constants by sizeofs or symbolic constants
1996-12-05 20:19:33 +00:00
Andrey A. Chernov
0f456e3c6e Use UT_* contstants when possible instead of harcoded 8
2.2 candidate
1996-12-05 17:12:51 +00:00
Bruce Evans
0c8ea4d48c Eliminated includes of the "temporary" backwards compatibility header
<sys/dir.h> in applications.  Maintained existing (inadequate) ifdefs
for dir.h vs dirent.h in libdialog, amd and rarpd, but didn't add any
new ones.
1996-09-24 08:08:11 +00:00
Mike Pritchard
f3c0267f19 Fix some incorrect locations in the FILES sections of some man pages. 1996-02-02 18:22:04 +00:00
Andrey A. Chernov
f6d3b9ac8f Add setlocale LT_TIME 1995-10-24 04:09:49 +00:00
Andrey A. Chernov
8327624e76 Change ctime to strftime %c to use national date/time representation. 1995-08-08 00:15:16 +00:00
Rodney W. Grimes
7799f52a32 Remove trailing whitespace. 1995-05-30 06:41:30 +00:00
Andreas Schulz
04dc4fc21c My prevoius commit missed some things. The out_line didn't need
to be padded to 8 chars. Simply make sure that never more than 8 chars
are printed ( %-.8s ). The former commit otherwise hosed the width
calculation and landed on different positions for the time output.
Also the strlen(xx_out_line) hoses the wide
calculation, so that it sometimes make it much larger than necessary.
Simply use always 8 chars for the out_line calculation now. Looks good
this way.
1994-12-27 00:53:14 +00:00
Andreas Schulz
9066320224 The out_line doesn't need to be zero terminated, so print it not with %s
but with a %-8.8s instead. this prevents funny output, if the out_line
contains a long hostname that is larger than 8 chars.
1994-12-26 17:29:03 +00:00
Rodney W. Grimes
9b50d90275 BSD 4.4 Lite Usr.bin Sources 1994-05-27 12:33:43 +00:00