freebsd-skq/lib/libc/sys
pjd f07ebb8888 Merge Capsicum overhaul:
- Capability is no longer separate descriptor type. Now every descriptor
  has set of its own capability rights.

- The cap_new(2) system call is left, but it is no longer documented and
  should not be used in new code.

- The new syscall cap_rights_limit(2) should be used instead of
  cap_new(2), which limits capability rights of the given descriptor
  without creating a new one.

- The cap_getrights(2) syscall is renamed to cap_rights_get(2).

- If CAP_IOCTL capability right is present we can further reduce allowed
  ioctls list with the new cap_ioctls_limit(2) syscall. List of allowed
  ioctls can be retrived with cap_ioctls_get(2) syscall.

- If CAP_FCNTL capability right is present we can further reduce fcntls
  that can be used with the new cap_fcntls_limit(2) syscall and retrive
  them with cap_fcntls_get(2).

- To support ioctl and fcntl white-listing the filedesc structure was
  heavly modified.

- The audit subsystem, kdump and procstat tools were updated to
  recognize new syscalls.

- Capability rights were revised and eventhough I tried hard to provide
  backward API and ABI compatibility there are some incompatible changes
  that are described in detail below:

	CAP_CREATE old behaviour:
	- Allow for openat(2)+O_CREAT.
	- Allow for linkat(2).
	- Allow for symlinkat(2).
	CAP_CREATE new behaviour:
	- Allow for openat(2)+O_CREAT.

	Added CAP_LINKAT:
	- Allow for linkat(2). ABI: Reuses CAP_RMDIR bit.
	- Allow to be target for renameat(2).

	Added CAP_SYMLINKAT:
	- Allow for symlinkat(2).

	Removed CAP_DELETE. Old behaviour:
	- Allow for unlinkat(2) when removing non-directory object.
	- Allow to be source for renameat(2).

	Removed CAP_RMDIR. Old behaviour:
	- Allow for unlinkat(2) when removing directory.

	Added CAP_RENAMEAT:
	- Required for source directory for the renameat(2) syscall.

	Added CAP_UNLINKAT (effectively it replaces CAP_DELETE and CAP_RMDIR):
	- Allow for unlinkat(2) on any object.
	- Required if target of renameat(2) exists and will be removed by this
	  call.

	Removed CAP_MAPEXEC.

	CAP_MMAP old behaviour:
	- Allow for mmap(2) with any combination of PROT_NONE, PROT_READ and
	  PROT_WRITE.
	CAP_MMAP new behaviour:
	- Allow for mmap(2)+PROT_NONE.

	Added CAP_MMAP_R:
	- Allow for mmap(PROT_READ).
	Added CAP_MMAP_W:
	- Allow for mmap(PROT_WRITE).
	Added CAP_MMAP_X:
	- Allow for mmap(PROT_EXEC).
	Added CAP_MMAP_RW:
	- Allow for mmap(PROT_READ | PROT_WRITE).
	Added CAP_MMAP_RX:
	- Allow for mmap(PROT_READ | PROT_EXEC).
	Added CAP_MMAP_WX:
	- Allow for mmap(PROT_WRITE | PROT_EXEC).
	Added CAP_MMAP_RWX:
	- Allow for mmap(PROT_READ | PROT_WRITE | PROT_EXEC).

	Renamed CAP_MKDIR to CAP_MKDIRAT.
	Renamed CAP_MKFIFO to CAP_MKFIFOAT.
	Renamed CAP_MKNODE to CAP_MKNODEAT.

	CAP_READ old behaviour:
	- Allow pread(2).
	- Disallow read(2), readv(2) (if there is no CAP_SEEK).
	CAP_READ new behaviour:
	- Allow read(2), readv(2).
	- Disallow pread(2) (CAP_SEEK was also required).

	CAP_WRITE old behaviour:
	- Allow pwrite(2).
	- Disallow write(2), writev(2) (if there is no CAP_SEEK).
	CAP_WRITE new behaviour:
	- Allow write(2), writev(2).
	- Disallow pwrite(2) (CAP_SEEK was also required).

	Added convinient defines:

	#define	CAP_PREAD		(CAP_SEEK | CAP_READ)
	#define	CAP_PWRITE		(CAP_SEEK | CAP_WRITE)
	#define	CAP_MMAP_R		(CAP_MMAP | CAP_SEEK | CAP_READ)
	#define	CAP_MMAP_W		(CAP_MMAP | CAP_SEEK | CAP_WRITE)
	#define	CAP_MMAP_X		(CAP_MMAP | CAP_SEEK | 0x0000000000000008ULL)
	#define	CAP_MMAP_RW		(CAP_MMAP_R | CAP_MMAP_W)
	#define	CAP_MMAP_RX		(CAP_MMAP_R | CAP_MMAP_X)
	#define	CAP_MMAP_WX		(CAP_MMAP_W | CAP_MMAP_X)
	#define	CAP_MMAP_RWX		(CAP_MMAP_R | CAP_MMAP_W | CAP_MMAP_X)
	#define	CAP_RECV		CAP_READ
	#define	CAP_SEND		CAP_WRITE

	#define	CAP_SOCK_CLIENT \
		(CAP_CONNECT | CAP_GETPEERNAME | CAP_GETSOCKNAME | CAP_GETSOCKOPT | \
		 CAP_PEELOFF | CAP_RECV | CAP_SEND | CAP_SETSOCKOPT | CAP_SHUTDOWN)
	#define	CAP_SOCK_SERVER \
		(CAP_ACCEPT | CAP_BIND | CAP_GETPEERNAME | CAP_GETSOCKNAME | \
		 CAP_GETSOCKOPT | CAP_LISTEN | CAP_PEELOFF | CAP_RECV | CAP_SEND | \
		 CAP_SETSOCKOPT | CAP_SHUTDOWN)

	Added defines for backward API compatibility:

	#define	CAP_MAPEXEC		CAP_MMAP_X
	#define	CAP_DELETE		CAP_UNLINKAT
	#define	CAP_MKDIR		CAP_MKDIRAT
	#define	CAP_RMDIR		CAP_UNLINKAT
	#define	CAP_MKFIFO		CAP_MKFIFOAT
	#define	CAP_MKNOD		CAP_MKNODAT
	#define	CAP_SOCK_ALL		(CAP_SOCK_CLIENT | CAP_SOCK_SERVER)

Sponsored by:	The FreeBSD Foundation
Reviewed by:	Christoph Mallon <christoph.mallon@gmx.de>
Many aspects discussed with:	rwatson, benl, jonathan
ABI compatibility discussed with:	kib
2013-03-02 00:53:12 +00:00
..
__error.c Fix many "function declaration isn't a prototype" warnings in libc. 2009-12-05 19:31:38 +00:00
__vdso_gettimeofday.c Rework the __vdso_* symbols attributes to only make the symbols weak, 2013-01-30 12:48:16 +00:00
_exit.2
abort2.2
accept.2 Attempt to reduce accidental foot-shooting by pointing out that 2009-11-02 07:21:13 +00:00
access.2 mdoc: move CAVEATS, BUGS and SECURITY CONSIDERATIONS sections to the 2010-05-13 12:07:55 +00:00
acct.2
adjtime.2
aio_cancel.2 style(9) cleanup 2008-04-03 02:41:54 +00:00
aio_error.2
aio_read.2 mdoc: drop redundant .Pp and .LP calls 2010-10-08 12:40:16 +00:00
aio_return.2
aio_suspend.2 style(9) cleanup 2008-04-03 02:41:54 +00:00
aio_waitcomplete.2
aio_write.2 mdoc: drop redundant .Pp and .LP calls 2010-10-08 12:40:16 +00:00
bind.2 Document that bind(2) can fail with EAFNOSUPPORT. 2012-12-04 09:53:09 +00:00
brk.2
cap_enter.2 Merge Capsicum overhaul: 2013-03-02 00:53:12 +00:00
cap_fcntls_limit.2 Merge Capsicum overhaul: 2013-03-02 00:53:12 +00:00
cap_ioctls_limit.2 Merge Capsicum overhaul: 2013-03-02 00:53:12 +00:00
cap_rights_limit.2 Merge Capsicum overhaul: 2013-03-02 00:53:12 +00:00
chdir.2
chflags.2 Fix logic inversion. 2013-02-09 17:13:51 +00:00
chmod.2 Update sticky(7) cross references. 2011-05-13 16:29:57 +00:00
chown.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
chroot.2 - Use standard RETURN VALUES section. 2013-01-15 14:09:08 +00:00
clock_gettime.2 mdoc: drop redundant .Pp and .LP calls 2010-10-08 12:40:16 +00:00
clock_gettime.c Use struct vdso_timehands data to implement fast gettimeofday(2) and 2012-06-22 07:13:30 +00:00
close.2 Clarify the implementation-defined behaviour in case of close(2) 2012-01-22 11:58:17 +00:00
closefrom.2 Add a new 'void closefrom(int lowfd)' system call. When called, it closes 2009-06-15 20:38:55 +00:00
connect.2 Add ECONNRESET to list of possible errors in connect(2). 2010-09-06 21:39:54 +00:00
cpuset_getaffinity.2 Remove trailing whitespace per mdoc lint warning 2012-03-29 05:02:12 +00:00
cpuset.2 Remove trailing whitespace per mdoc lint warning 2012-03-29 05:02:12 +00:00
dup.2 Merge Capsicum overhaul: 2013-03-02 00:53:12 +00:00
execve.2 Fix exec_imgact_shell()'s handling of two error cases: (1) Previously, if 2010-09-21 16:24:51 +00:00
extattr_get_file.2 Update this manual page to describe the extattr_list_file() and the 2008-01-29 18:15:38 +00:00
fcntl.2 Make the F_READAHEAD option to fcntl(2) work as documented: a value of zero 2013-02-13 15:09:16 +00:00
fcntl.c (Incomplete) fixes for symbols visibility issues and style in fcntl.h. 2012-07-21 13:02:11 +00:00
ffclock.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
fhopen.2
flock.2 Document that flock can return ENOLCK 2011-11-10 06:20:18 +00:00
fork.2
fsync.2
ftruncate.c
getdirentries.2 Globally replace u_int*_t from (non-contributed) man pages. 2012-02-12 18:29:56 +00:00
getdtablesize.2
getfh.2 getfh(2): Add xrefs for fhopen(2), open(2), stat(2). 2011-04-14 22:06:11 +00:00
getfsstat.2
getgid.2
getgroups.2 getgroups(2): Remove mention of <sys/param.h> and refer to sysconf(3). 2011-01-21 22:15:17 +00:00
getitimer.2 mdoc: remove literal tabs where they don't belong 2010-06-08 16:48:59 +00:00
getlogin.2
getloginclass.2 Add manual page for getloginclass(2) and setloginclass(2). 2011-03-06 08:35:50 +00:00
getpeername.2 Document that getpeername(2) and getsockname(2) can fail with EINVAL. 2012-11-23 10:14:54 +00:00
getpgrp.2
getpid.2
getpriority.2 mdoc: make pages render with mandoc 2010-10-21 12:27:13 +00:00
getrlimit.2 Update xrefs from 4.3BSD to modern signal functions in various man pages. 2010-05-06 22:49:54 +00:00
getrusage.2 mdoc: remove literal tabs where they don't belong 2010-06-08 16:48:59 +00:00
getsid.2
getsockname.2 Document that getpeername(2) and getsockname(2) can fail with EINVAL. 2012-11-23 10:14:54 +00:00
getsockopt.2 Document SO_PROTOCOL socket option. 2012-02-26 13:57:24 +00:00
gettimeofday.2 mdoc: drop redundant .Pp and .LP calls 2010-10-08 12:40:16 +00:00
gettimeofday.c Rework the __vdso_* symbols attributes to only make the symbols weak, 2013-01-30 12:48:16 +00:00
getuid.2
intro.2 Add description of ECAPMODE to errno(2) man page. 2011-03-03 11:29:48 +00:00
ioctl.2 Document FIONREAD, FIONWRITE and FIONSPACE. 2010-05-11 17:02:12 +00:00
issetugid.2
jail.2 A new jail(8) with a configuration file, ultimately to replace the work 2012-04-26 17:36:05 +00:00
kenv.2
kill.2 Update the kill(2) and killpg(2) man pages to the modern permission 2012-10-22 03:37:00 +00:00
kldfind.2
kldfirstmod.2
kldload.2
kldnext.2
kldstat.2 Fix comment to specify correct struct name. 2012-03-28 23:51:06 +00:00
kldsym.2 mdoc: drop redundant .Pp and .LP calls 2010-10-08 12:40:16 +00:00
kldunload.2 Document that kldunloadf can return EINVAL. 2008-12-25 09:15:31 +00:00
kqueue.2 Note that SIGCHLD is special and if ignored, won't be recorded by the filter. 2013-01-21 22:07:34 +00:00
kse.2 mdoc: Ud takes no argument. 2012-03-29 16:20:20 +00:00
ktrace.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
link.2 Correct AT_SYMLINK_FOLLOW flag name in linkat(2) man page. 2009-07-19 16:48:25 +00:00
lio_listio.2
listen.2 Grammar fixes to r241781. 2012-10-20 19:38:22 +00:00
lseek.2 Clarify the SEEK_HOLE description, it repositions the file pointer. 2012-05-26 05:25:55 +00:00
lseek.c
madvise.2 Add the posix_fadvise(2) system call. It is somewhat similar to 2011-11-04 04:02:50 +00:00
Makefile.inc Merge Capsicum overhaul: 2013-03-02 00:53:12 +00:00
mincore.2 Add support to mincore for detecting whether a page is part of a 2008-03-28 04:29:27 +00:00
minherit.2 Bump manpage date, missed during the last change. 2007-10-30 15:28:43 +00:00
mkdir.2 - Forgot to bump a date after last change 2008-06-30 08:46:09 +00:00
mkfifo.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
mknod.2 mknod(2): The required include is <sys/stat.h>, not <unistd.h>. 2011-01-16 21:59:50 +00:00
mlock.2 - Update manual pages accordingly to r244384 and r244385. 2012-12-25 13:43:01 +00:00
mlockall.2 - Update manual pages accordingly to r244384 and r244385. 2012-12-25 13:43:01 +00:00
mmap.2 Do not claim that msync(2) is obsoleted [1]. 2012-03-17 23:55:18 +00:00
mmap.c
modfind.2
modnext.2
modstat.2 mdoc: drop redundant .Pp and .LP calls 2010-10-08 12:40:16 +00:00
mount.2 Change the current working directory to be inside the jail created by 2010-05-27 03:15:04 +00:00
mprotect.2
mq_close.2 mdoc: remove literal tabs where they don't belong 2010-06-08 16:48:59 +00:00
mq_getattr.2 mdoc: remove literal tabs where they don't belong 2010-06-08 16:48:59 +00:00
mq_notify.2 mdoc: remove literal tabs where they don't belong 2010-06-08 16:48:59 +00:00
mq_open.2 mdoc: remove literal tabs where they don't belong 2010-06-08 16:48:59 +00:00
mq_receive.2 mdoc: remove literal tabs where they don't belong 2010-06-08 16:48:59 +00:00
mq_send.2 mdoc: remove literal tabs where they don't belong 2010-06-08 16:48:59 +00:00
mq_setattr.2 mq_setattr(2): Add missing const to man page. 2011-05-17 21:03:34 +00:00
msgctl.2 Move msg{snd,recv,get,ctl} manual pages from section 3 to 2. 2009-07-13 12:53:43 +00:00
msgget.2 Move msg{snd,recv,get,ctl} manual pages from section 3 to 2. 2009-07-13 12:53:43 +00:00
msgrcv.2 Move msg{snd,recv,get,ctl} manual pages from section 3 to 2. 2009-07-13 12:53:43 +00:00
msgsnd.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
msync.2 Do not claim that msync(2) is obsoleted [1]. 2012-03-17 23:55:18 +00:00
munmap.2
nanosleep.2 In nanosleep(2), note that the calling thread is put to sleep, not the 2009-10-11 16:23:11 +00:00
nfssvc.2 Globally replace u_int*_t from (non-contributed) man pages. 2012-02-12 18:29:56 +00:00
ntp_adjtime.2 Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while 2010-08-16 15:18:30 +00:00
open.2 Document the ERESTART translation to EINTR for devfs nodes. 2013-02-07 15:11:43 +00:00
pathconf.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
pdfork.2 fix a further typo in the pdfork(2) man page. 2012-04-30 08:00:52 +00:00
pipe.2 Several cleanups related to pipe(2). 2008-11-11 14:55:59 +00:00
poll.2
posix_fadvise.2 posix_fadvise(2) first appeared in FreeBSD 9.1 2013-01-23 10:50:52 +00:00
posix_fallocate.2 Remove superfluous paragraph macro. 2012-03-25 12:13:24 +00:00
posix_openpt.2 Integrate the new MPSAFE TTY layer to the FreeBSD operating system. 2008-08-20 08:31:58 +00:00
pread.c
profil.2
pselect.2 Move pselect(3) man page to section 2. 2009-10-28 11:14:32 +00:00
ptrace.2 Document the detail of interaction between vfork and PT_TRACEME. 2013-02-07 15:36:24 +00:00
pwrite.c
quotactl.2 Remove trailing whitespace per mdoc lint warning 2012-03-29 05:02:12 +00:00
read.2 pread(2) might fail with EBUSY, so document it 2012-04-29 22:23:00 +00:00
readlink.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
reboot.2
recv.2 Remove the restrict qualifier to match function prototype. 2012-09-20 02:25:18 +00:00
rename.2 Add one more EACCES clause to rename.2. 2008-11-07 15:01:40 +00:00
revoke.2 Add revoke(1). 2009-06-15 21:52:27 +00:00
rfork.2 Document RFTSIGZMB. Fix spelling of SIGCHLD. Note that signals are 2011-07-12 20:38:42 +00:00
rmdir.2
rtprio.2 Document that rtprio(2) and rtprio_thread(2) can fail with EFAULT 2012-11-16 09:56:25 +00:00
sched_get_priority_max.2
sched_setparam.2
sched_setscheduler.2 mdoc: drop redundant .Pp and .LP calls 2010-10-08 12:40:16 +00:00
sched_yield.2
sctp_generic_recvmsg.2 Miscellaneous mdoc, spelling and inconsistency fixes. 2010-01-12 21:45:03 +00:00
sctp_generic_sendmsg.2 Remove trailing whitespace per mdoc lint warning 2012-03-29 05:02:12 +00:00
sctp_peeloff.2 Remove trailing whitespace per mdoc lint warning 2012-03-29 05:02:12 +00:00
select.2 Remove trailing whitespace per mdoc lint warning 2012-03-29 05:02:12 +00:00
semctl.2 Make the structure definitions in the man pages match the real code, and 2009-06-29 18:54:17 +00:00
semget.2
semop.2 Fix incorrect usage of 'assure' and 'insure'. 2010-08-28 16:32:01 +00:00
send.2 Standardize the various prison_foo_ip[46] functions and prison_if to 2009-02-05 14:06:09 +00:00
sendfile.2 Document that sendfile(2) can fail with ENOBUFS. 2012-11-14 01:45:10 +00:00
setfib.2 Remove tab from kernel configuration option. This is consistent with the rest 2012-05-12 16:08:05 +00:00
setgroups.2 In preparation for raising NGROUPS and NGROUPS_MAX, change base 2009-06-19 15:58:24 +00:00
setpgid.2 Describe what setpgid(2) does when pgid=0. The text has been 2009-12-01 06:12:31 +00:00
setregid.2
setresuid.2
setreuid.2
setsid.2
setuid.2 Make man page wording more clear: 2012-01-15 20:14:52 +00:00
shm_open.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
shmat.2 Update shmget(2) with POSIX access permissions and remove non-standard SHM_R, 2010-12-17 21:10:08 +00:00
shmctl.2 Update shmget(2) with POSIX access permissions and remove non-standard SHM_R, 2010-12-17 21:10:08 +00:00
shmget.2 Sort cross references by section. 2010-12-18 10:09:07 +00:00
shutdown.2
sigaction.2 sigaction(2),sigwait(2),sigwaitinfo(2): Remove [EFAULT] error condition. 2012-09-27 17:48:04 +00:00
sigaltstack.2 Use NULL instead of 0 for pointer in example. 2010-08-29 16:38:08 +00:00
sigpending.2
sigprocmask.2 sigprocmask(2): pthread_sigmask(3) must be used in threaded processes. 2010-05-07 20:46:22 +00:00
sigqueue.2 sigqueue(2): Fix typo (EEPERM -> EPERM). 2013-02-10 13:20:23 +00:00
sigreturn.2 Update xrefs from 4.3BSD to modern signal functions in various man pages. 2010-05-06 22:49:54 +00:00
sigstack.2
sigsuspend.2
sigwait.2 sigaction(2),sigwait(2),sigwaitinfo(2): Remove [EFAULT] error condition. 2012-09-27 17:48:04 +00:00
sigwait.c Because POSIX does not allow EINTR to be returned from sigwait(), 2010-09-10 01:47:37 +00:00
sigwaitinfo.2 sigaction(2),sigwait(2),sigwaitinfo(2): Remove [EFAULT] error condition. 2012-09-27 17:48:04 +00:00
socket.2 Document that socket(2) may fail with EAFNOSUPPORT if the family cannot 2012-12-07 02:26:08 +00:00
socketpair.2
stack_protector_compat.c Move the __stack_chk_fail_local@FBSD_1.0 compat symbol definition into 2010-08-24 12:58:54 +00:00
stack_protector.c Clang related fixes: 2010-10-13 16:57:06 +00:00
stat.2 Remove invalid remark about pipes. 2012-06-02 10:50:25 +00:00
statfs.2
swapon.2
Symbol.map Merge Capsicum overhaul: 2013-03-02 00:53:12 +00:00
symlink.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
sync.2
sysarch.2
syscall.2
timer_create.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
timer_delete.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
timer_settime.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
truncate.2
truncate.c
umask.2
undelete.2
unlink.2 General mdoc(7) and typo fixes. 2012-05-08 18:56:21 +00:00
utimes.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
utrace.2 The NetBSD Foundation has granted permission to remove clause 3 and 4 from 2010-03-02 17:20:04 +00:00
uuidgen.2
vfork.2 Update xrefs from 4.3BSD to modern signal functions in various man pages. 2010-05-06 22:49:54 +00:00
wait.2 Document wait6() and waitid(). 2012-11-13 12:56:42 +00:00
write.2 The sys/uio.h header is needed only for readv(2), preadv(2), writev(2) and 2012-01-22 11:15:48 +00:00