Initial clean up the language in the manual pages.

Summary: The manual pages need a bit of editing for language and clarity.

Reviewers: oshogbo, #manpages

Subscribers: imp

Differential Revision: https://reviews.freebsd.org/D32976
This commit is contained in:
George V. Neville-Neil 2021-11-10 01:38:36 -05:00
parent 123b5b8763
commit 406feaa862
3 changed files with 76 additions and 67 deletions

View file

@ -78,68 +78,71 @@
.Sh DESCRIPTION
The
.Nm libcasper
library allows to manage application capabilities through the casper process.
library provides for the control of application capabilities through the casper process.
.Pp
The application capability (represented by the
An application capability, represented by the
.Vt cap_channel_t
type) is a communication channel between the caller and the casper process
daemon or an instance of one of its services.
A capability to the casper process obtained with the
type, is a communication channel between the caller and the casper
daemon or an instance of one of the daemon's services.
A capability to the casper process, obtained with the
.Fn cap_init
function allows to create capabilities to casper's services via the
function, allows a program to create capabilities to acacce
the casper daemon's services via the
.Fn cap_service_open
function.
.Pp
The
.Fn cap_init
function opens capability to the casper process.
function instantiates a capability to allow a program to access
the casper daemon.
.Pp
The
.Fn cap_wrap
function creates
function creates a
.Vt cap_channel_t
based on the given socket.
The function is used when capability is inherited through
based on the socket supplied in the call.
The function is used when a capability is inherited through the
.Xr execve 2
or send over
system call,
or sent over a
.Xr unix 4
domain socket as a regular file descriptor and has to be represented as
.Vt cap_channel_t
again.
domain socket as a file descriptor,
nd has to be converted into a
.Vt cap_channel_t .
The
.Fa flags
argument defines the channel behavior.
The supported flags are:
.Bl -ohang -offset indent
.It CASPER_NO_UNIQ
The communication between process and casper uses no unique version of nvlist.
The communication between the process and the casper daemon no unique version of nvlist.
.El
.Pp
The
.Fn cap_unwrap
function is the opposite of the
.Fn cap_wrap
function.
It frees the
.Vt cap_channel_t
structure and returns
function returns the
.Xr unix 4
domain socket associated with it.
domain socket that was provided to the
.Fn cap_wrap
function,
and frees the
.Vt cap_channel_t
structure.
.Pp
The
.Fn cap_clone
function clones the given capability.
function returns a clone of the capability passed as its only argument.
.Pp
The
.Fn cap_close
function closes the given capability.
function closes, and frees, the given capability.
.Pp
The
.Fn cap_sock
function returns
function returns the
.Xr unix 4
domain socket descriptor associated with the given capability for use with
system calls like
system calls such as:
.Xr kevent 2 ,
.Xr poll 2
and
@ -147,33 +150,36 @@ and
.Pp
The
.Fn cap_limit_get
function stores current limits of the given capability in the
function stores the current limits of the given capability in the
.Fa limitsp
argument.
If the function return
If the function returns
.Va 0
and
.Dv NULL
is stored in
is stored in the
.Fa limitsp
it means there are no limits set.
argument,
there are no limits set.
.Pp
The
.Fn cap_limit_set
function sets limits for the given capability.
The limits are provided as a
The limits are provided as an
.Xr nvlist 9 .
The exact format depends on the service the capability represents.
The exact format of the limits depends on the service that the
capability represents.
.Fn cap_limit_set
frees the limits regardless of whether the operation succeeds or fails.
frees the limits passed to the call,
whether or not the operation succeeds or fails.
.Pp
The
.Fn cap_send_nvlist
function sends the given
.Xr nvlist 9
over the given capability.
This is low level interface to communicate with casper services.
Most services should provide higher level API.
This is a low level interface to communicate with casper services.
It is expected that most services will provide a higher level API.
.Pp
The
.Fn cap_recv_nvlist
@ -185,41 +191,43 @@ The
.Fn cap_xfer_nvlist
function sends the given
.Xr nvlist 9 ,
destroys it and receives new
destroys it, and receives a new
.Xr nvlist 9
in response over the given capability.
It does not matter if the function succeeds or fails, the
.Xr nvlist 9
given for sending will always be destroyed once the function returns.
given for sending will always be destroyed before the function returns.
.Pp
The
.Fn cap_service_open
function opens casper service of the given name through casper capability
obtained via the
function opens the casper service named in the call using
the casper capability obtained via the
.Fn cap_init
function.
The function returns capability that provides access to opened service.
The
.Fn cap_service_open
function returns a capability that provides access to the opened service.
Casper supports the following services in the base system:
.Pp
.Bl -tag -width "system.random" -compact -offset indent
.It system.dns
provides DNS libc compatible API
provides libc compatible DNS API
.It system.grp
provides
provides a
.Xr getgrent 3
compatible API
.It system.net
provides network libc compatible API
provides a libc compatible network API
.It system.pwd
provides
provides a
.Xr getpwent 3
compatible API
.It system.sysctl
provides
provides a
.Xr sysctlbyname 3
compatible API
.It system.syslog
provides
provides a
.Xr syslog 3
compatible API
.El

View file

@ -47,7 +47,7 @@ typedef int service_command_func_t(const char *, const nvlist_t *, nvlist_t *,
.Sh DESCRIPTION
The
.Nm CREATE_SERVICE
macro to create a new Casper service.
macro is used to create a new Casper service.
The
.Fa name
is a string containing the service name, which will be used in the
@ -57,44 +57,43 @@ function to identify it.
The
.Fa limit_func
is a function of type
.Li service_limit_func_t .
The first argument of the function contains
.Li service_limit_func_t
where the first argument of the function contains an containing
.Xr nvlist 9 ,
old service limits and second one the new limits.
If the services wasn't limited the old limits will be set to
old service limits and the second argument contains the new limits.
If the service wasn't limited then the old limits will be set to
.Dv NULL .
This function should not allow to extend service limits and only limit it
further.
This function must not allow the extension of service limits.
The
.Fa command_func
is a function of type
.Li service_command_func_t .
First argument is the name of the command that should be executed.
.Li service_command_func_t
where the first argument is the name of the command that should be executed.
The first
.Xr nvlist 9
contains the current limits.
Next one contains a
contains the current limits and the second contains an
.Xr nvlist 9
with current request.
The last one contains an output
with the current request.
The last argument contains a return value
.Xr nvlist 9
which contains the response from Casper.
.Pp
The
.Fa flags
argument defines limits of the service.
argument defines the limits of the service.
The supported flags are:
.Bl -ohang -offset indent
.It CASPER_SERVICE_STDIO
The Casper service has access to the stdio descriptors from the process it was
spawned from.
.It CASPER_SERVICE_FD
The Casper service has access to all descriptors besides stdio descriptors from
the process it was spawned from.
The Casper service has access to all of the descriptors,
besides the stdio descriptors,
from the process it was spawned from.
.It CASPER_SERVICE_NO_UNIQ_LIMITS
The whole Casper communication is using
The whole Casper communication is using an
.Xr nvlist 9
with
with the
.Xr NVLIST_NO_UNIQ 9
flag.
.El

View file

@ -91,7 +91,7 @@ The functions
.Fn cap_gethostbyaddr
and
.Fn cap_getnameinfo
are respectively equivalent to
provide a set of APIs equivalent to
.Xr bind 2 ,
.Xr connect 2 ,
.Xr gethostbyname 3 ,
@ -99,7 +99,7 @@ are respectively equivalent to
.Xr gethostbyaddr 3
and
.Xr getnameinfo 3
except that the connection to the
except that a connection to the
.Nm system.net
service needs to be provided.
.Sh LIMITS
@ -107,8 +107,10 @@ By default, the cap_net capability provides unrestricted access to the network
namespace.
Applications typically only require access to a small portion of the network
namespace:
The
.Fn cap_net_limit
interface can be used to restrict access to the network.
function can be used to restrict access to the network.
The
.Fn cap_net_limit_init
returns an opaque limit handle used to store a list of capabilities.
The