mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-06 17:18:32 +00:00
Introduce caph_enter and caph_enter_casper.
The caph_enter function should made it easier to sandbox application and not force us to remember that we need to check errno on failure. Another function is also checking if casper is present. Reviewed by: emaste, cem (partially) Differential Revision: https://reviews.freebsd.org/D14557
This commit is contained in:
parent
1f7ce05d1d
commit
cfb13e0a97
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=333330
|
@ -24,7 +24,7 @@
|
||||||
.\"
|
.\"
|
||||||
.\" $FreeBSD$
|
.\" $FreeBSD$
|
||||||
.\"
|
.\"
|
||||||
.Dd October 21, 2016
|
.Dd May 7, 2018
|
||||||
.Dt CAPSICUM_HELPERS 3
|
.Dt CAPSICUM_HELPERS 3
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
|
@ -41,6 +41,10 @@
|
||||||
.Sh SYNOPSIS
|
.Sh SYNOPSIS
|
||||||
.In capsicum_helpers.h
|
.In capsicum_helpers.h
|
||||||
.Ft int
|
.Ft int
|
||||||
|
.Fn caph_enter "void"
|
||||||
|
.Ft int
|
||||||
|
.Fn caph_enter_casper "void"
|
||||||
|
.Ft int
|
||||||
.Fn caph_limit_stream "int fd, int flags"
|
.Fn caph_limit_stream "int fd, int flags"
|
||||||
.Ft int
|
.Ft int
|
||||||
.Fn caph_limit_stdin "void"
|
.Fn caph_limit_stdin "void"
|
||||||
|
@ -56,6 +60,19 @@
|
||||||
.Fn caph_cache_catpages "void"
|
.Fn caph_cache_catpages "void"
|
||||||
.Sh DESCRIPTION
|
.Sh DESCRIPTION
|
||||||
The
|
The
|
||||||
|
.Nm caph_enter
|
||||||
|
is equivalent to the
|
||||||
|
.Xr cap_enter 2
|
||||||
|
it returns success when the kernel is built without support of the capability
|
||||||
|
mode.
|
||||||
|
.Pp
|
||||||
|
The
|
||||||
|
.Nm caph_enter_casper
|
||||||
|
is equivalent to the
|
||||||
|
.Nm caph_enter
|
||||||
|
it returns success when the system is built without Casper support.
|
||||||
|
.Pp
|
||||||
|
The
|
||||||
.Nm capsicum helpers
|
.Nm capsicum helpers
|
||||||
are a set of a inline functions which simplify modifying programs to use
|
are a set of a inline functions which simplify modifying programs to use
|
||||||
Capsicum.
|
Capsicum.
|
||||||
|
|
|
@ -39,6 +39,8 @@
|
||||||
#include <time.h>
|
#include <time.h>
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
|
|
||||||
|
#include <libcasper.h>
|
||||||
|
|
||||||
#define CAPH_IGNORE_EBADF 0x0001
|
#define CAPH_IGNORE_EBADF 0x0001
|
||||||
#define CAPH_READ 0x0002
|
#define CAPH_READ 0x0002
|
||||||
#define CAPH_WRITE 0x0004
|
#define CAPH_WRITE 0x0004
|
||||||
|
@ -122,4 +124,22 @@ caph_cache_catpages(void)
|
||||||
(void)catopen("libc", NL_CAT_LOCALE);
|
(void)catopen("libc", NL_CAT_LOCALE);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static __inline int
|
||||||
|
caph_enter(void)
|
||||||
|
{
|
||||||
|
|
||||||
|
if (cap_enter() < 0 && errno != ENOSYS)
|
||||||
|
return (-1);
|
||||||
|
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static __inline int
|
||||||
|
caph_enter_casper(void)
|
||||||
|
{
|
||||||
|
|
||||||
|
return (CASPER_SUPPORT == 0 ? 0 : caph_enter());
|
||||||
|
}
|
||||||
|
|
||||||
#endif /* _CAPSICUM_HELPERS_H_ */
|
#endif /* _CAPSICUM_HELPERS_H_ */
|
||||||
|
|
Loading…
Reference in a new issue