From 800e6812e23ec71bb85478a55edf8f7b7a106a0b Mon Sep 17 00:00:00 2001 From: csjp Date: Tue, 28 Jan 2014 01:49:49 +0000 Subject: [PATCH] Allow sigwait(2) in capabilities mode. It's common for multi-threaded processes to create a thread for the purpose of synchronously processing signals. Allow such processes to utilize a capabilities sandbox. Discussed with: rwatson, pjd MFC after: 2 weeks --- sys/kern/capabilities.conf | 1 + sys/kern/init_sysent.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/kern/capabilities.conf b/sys/kern/capabilities.conf index 8d33472f5b34..f7a46aebce2c 100644 --- a/sys/kern/capabilities.conf +++ b/sys/kern/capabilities.conf @@ -667,6 +667,7 @@ sigsuspend sigtimedwait sigvec sigwaitinfo +sigwait ## ## Allow creating new socket pairs with socket(2) and socketpair(2). diff --git a/sys/kern/init_sysent.c b/sys/kern/init_sysent.c index 6c94f3d3f578..0f99f60b5126 100644 --- a/sys/kern/init_sysent.c +++ b/sys/kern/init_sysent.c @@ -463,7 +463,7 @@ struct sysent sysent[] = { { AS(__acl_set_link_args), (sy_call_t *)sys___acl_set_link, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 426 = __acl_set_link */ { AS(__acl_delete_link_args), (sy_call_t *)sys___acl_delete_link, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 427 = __acl_delete_link */ { AS(__acl_aclcheck_link_args), (sy_call_t *)sys___acl_aclcheck_link, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 428 = __acl_aclcheck_link */ - { AS(sigwait_args), (sy_call_t *)sys_sigwait, AUE_SIGWAIT, NULL, 0, 0, 0, SY_THR_STATIC }, /* 429 = sigwait */ + { AS(sigwait_args), (sy_call_t *)sys_sigwait, AUE_SIGWAIT, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 429 = sigwait */ { AS(thr_create_args), (sy_call_t *)sys_thr_create, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 430 = thr_create */ { AS(thr_exit_args), (sy_call_t *)sys_thr_exit, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 431 = thr_exit */ { AS(thr_self_args), (sy_call_t *)sys_thr_self, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 432 = thr_self */