From 47312af69a0198ef49ada365cab260398b0f5d70 Mon Sep 17 00:00:00 2001
From: Allan Jude <allanjude@FreeBSD.org>
Date: Sat, 7 Jan 2017 04:57:21 +0000
Subject: [PATCH] Capsicum: add capability mode to users binary

Submitted by:	Tyler Littlefield <tyler@tysdomain.com>
Reviewed by:	cem, oshogbo
Differential Revision:	https://reviews.freebsd.org/D9046
---
 usr.bin/users/users.cc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/usr.bin/users/users.cc b/usr.bin/users/users.cc
index 914888d98870..2d47786d46aa 100644
--- a/usr.bin/users/users.cc
+++ b/usr.bin/users/users.cc
@@ -27,9 +27,12 @@
  * SUCH DAMAGE.
  */
 
+#include <sys/capsicum.h>
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include <err.h>
+#include <errno.h>
 #include <utmpx.h>
 
 #include <algorithm>
@@ -51,6 +54,10 @@ main(int argc, char **)
 	}
 
 	setutxent();
+
+	if (cap_enter() < 0 && errno != ENOSYS)
+		err(1, "Failed to enter capability mode.");
+
 	while ((ut = getutxent()) != NULL)
 		if (ut->ut_type == USER_PROCESS)
 			names.insert(ut->ut_user);