Commit Graph

12 Commits

Author SHA1 Message Date
Kyle Evans
990beb037d capsicum_helpers: split stream cap bits out of caph_limit_stream()
The goal here is to make it so applications can take the rights one would
normally get by calling caph_limit_stream() on a descriptor and build on
them as needed.

The tentatively planned use-case is an application that takes a socket and
hooks it up to std{err,out,in} for a fork()d child. It may be feasible to
apply limitations to such descriptors as long as it's a superset of those
normally applied to stdio.

Reviewed by:	markj, oshobo (prior version; sans manpage addition)
Differential Revision:	https://reviews.freebsd.org/D22993
2020-01-02 23:07:45 +00:00
Emmanuel Vadot
4c1a82cea5 pkgbase: Create a FreeBSD-utilities package and make it the default one
The default package use to be FreeBSD-runtime but it should only contain
binaries and libs enough to boot to single user and repair the system, it
is also very handy to have a package that can be tranform to a small mfsroot.
So create a new package named FreeBSD-utilities and make it the default one.
Also move a few binaries and lib into this package when it make sense.
Reviewed by:	bapt, gjb
Differential Revision:	https://reviews.freebsd.org/D21506
2019-09-05 14:15:47 +00:00
Mariusz Zaborski
e57d2a07c0 libcapsicum: add missing links
Reported by:	manu
2018-12-12 20:32:17 +00:00
Mariusz Zaborski
5a453d5f5b libcapsicum: Introduce caph_{rights,ioctls,fcntls}_limit
The idea behind those functions is not to force consumers to remember that there
is a need to check errno on failure. We already have a caph_enter(3) function
which does the same for cap_enter(2).

MFC after:	2 weeks
2018-11-04 17:22:58 +00:00
Eitan Adler
8a3255c288 libcapsicum: adding missing man page links 2018-06-18 04:58:48 +00:00
Mariusz Zaborski
c3eed03d15 Add man pages for Capsicum helpers.
Reviewed by:	cem
Differential Revision:	https://reviews.freebsd.org/D8154
2016-10-05 20:02:34 +00:00
Mariusz Zaborski
7a6e3cf83e libcapsicum: introduce Capsicum helpers
Capsicum helpers are a set of inline functions which goal is to reduce
duplicated patterns used to Capsicumize applications.

Reviewed by:	cem, AllanJude, bapt, ed, emaste
Differential Revision:	https://reviews.freebsd.org/D8013
2016-10-03 20:48:18 +00:00
Glen Barber
659a0a5d64 Remove lib/libcapsicum and libexec/casper, brought back as
part of a merge mishap.

Reported by:	junovitch
Sponsored by:	The FreeBSD Foundation
2016-04-17 02:51:04 +00:00
Glen Barber
a70cba9582 First pass through library packaging.
Sponsored by:	The FreeBSD Foundation
2016-02-04 21:16:35 +00:00
Baptiste Daroussin
6b129086dc Convert libraries to use LIBADD
While here reduce a bit overlinking
2014-11-25 11:07:26 +00:00
Pawel Jakub Dawidek
0f984a9260 Both libcasper and libcapsicum libraries have to be installed in /lib/,
as they are used by /sbin/casperd.
2013-12-02 17:07:22 +00:00
Pawel Jakub Dawidek
42a8595256 Please welcome casperd daemon. It (and its services) will be responsible for
giving access to functionality that is not available in capability mode
sandbox. The functionality can be precisely restricted.

Start with the following services:
- system.dns - provides API compatible to:
	- gethostbyname(3),
	- gethostbyname2(3),
	- gethostbyaddr(3),
	- getaddrinfo(3),
	- getnameinfo(3),
- system.grp - provides getgrent(3)-compatible API,
- system.pwd - provides getpwent(3)-compatible API,
- system.random - allows to obtain entropy from /dev/random,
- system.sysctl - provides sysctlbyname(3-compatible API.

Sponsored by:	The FreeBSD Foundation
2013-12-02 08:21:28 +00:00