Date: Sun, 3 Mar 2013 10:05:16 +0000 (UTC) From: Adrian Chadd <adrian@FreeBSD.org> To: src-committers@freebsd.org, svn-src-user@freebsd.org Subject: svn commit: r247707 - in user/adrian/net80211_tx: . cddl/contrib/opensolaris/cmd/zfs cddl/contrib/opensolaris/lib/libzfs/common contrib/openbsm/etc etc lib/libc/gen lib/libc/include lib/libc/regex ... Message-ID: <201303031005.r23A5G9t083112@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: adrian Date: Sun Mar 3 10:05:15 2013 New Revision: 247707 URL: http://svnweb.freebsd.org/changeset/base/247707 Log: MFH Added: user/adrian/net80211_tx/lib/libc/gen/cap_sandboxed.3 - copied unchanged from r247706, head/lib/libc/gen/cap_sandboxed.3 user/adrian/net80211_tx/lib/libc/gen/cap_sandboxed.c - copied unchanged from r247706, head/lib/libc/gen/cap_sandboxed.c user/adrian/net80211_tx/lib/libc/sys/bindat.2 - copied unchanged from r247706, head/lib/libc/sys/bindat.2 user/adrian/net80211_tx/lib/libc/sys/cap_fcntls_limit.2 - copied unchanged from r247706, head/lib/libc/sys/cap_fcntls_limit.2 user/adrian/net80211_tx/lib/libc/sys/cap_ioctls_limit.2 - copied unchanged from r247706, head/lib/libc/sys/cap_ioctls_limit.2 user/adrian/net80211_tx/lib/libc/sys/cap_rights_limit.2 - copied unchanged from r247706, head/lib/libc/sys/cap_rights_limit.2 user/adrian/net80211_tx/lib/libc/sys/connectat.2 - copied unchanged from r247706, head/lib/libc/sys/connectat.2 user/adrian/net80211_tx/tools/regression/capsicum/ - copied from r247706, head/tools/regression/capsicum/ Deleted: user/adrian/net80211_tx/lib/libc/sys/cap_new.2 user/adrian/net80211_tx/lib/libprocstat/ntfs.c user/adrian/net80211_tx/sbin/mount_hpfs/ user/adrian/net80211_tx/sbin/mount_ntfs/ user/adrian/net80211_tx/share/examples/portal/ user/adrian/net80211_tx/share/man/man4/coda.4 user/adrian/net80211_tx/share/man/man5/xfs.5 user/adrian/net80211_tx/sys/fs/coda/ user/adrian/net80211_tx/sys/fs/hpfs/ user/adrian/net80211_tx/sys/fs/ntfs/ user/adrian/net80211_tx/sys/fs/portalfs/ user/adrian/net80211_tx/sys/gnu/fs/xfs/ user/adrian/net80211_tx/sys/modules/coda/ user/adrian/net80211_tx/sys/modules/coda5/ user/adrian/net80211_tx/sys/modules/hpfs/ user/adrian/net80211_tx/sys/modules/ntfs/ user/adrian/net80211_tx/sys/modules/ntfs_iconv/ user/adrian/net80211_tx/sys/modules/portalfs/ user/adrian/net80211_tx/sys/modules/xfs/ user/adrian/net80211_tx/usr.sbin/mount_portalfs/ Modified: user/adrian/net80211_tx/ObsoleteFiles.inc user/adrian/net80211_tx/UPDATING user/adrian/net80211_tx/cddl/contrib/opensolaris/cmd/zfs/zfs.8 user/adrian/net80211_tx/cddl/contrib/opensolaris/lib/libzfs/common/libzfs_impl.h user/adrian/net80211_tx/contrib/openbsm/etc/audit_event user/adrian/net80211_tx/etc/devd.conf user/adrian/net80211_tx/lib/libc/gen/Makefile.inc user/adrian/net80211_tx/lib/libc/include/compat.h user/adrian/net80211_tx/lib/libc/regex/regcomp.c user/adrian/net80211_tx/lib/libc/rpc/clnt_vc.c user/adrian/net80211_tx/lib/libc/sys/Makefile.inc user/adrian/net80211_tx/lib/libc/sys/Symbol.map user/adrian/net80211_tx/lib/libc/sys/cap_enter.2 user/adrian/net80211_tx/lib/libc/sys/dup.2 user/adrian/net80211_tx/lib/libedit/Makefile user/adrian/net80211_tx/lib/libprocstat/libprocstat.c user/adrian/net80211_tx/lib/libprocstat/libprocstat.h user/adrian/net80211_tx/lib/libstand/nandfs.c user/adrian/net80211_tx/sbin/ipfw/ipfw2.c user/adrian/net80211_tx/sys/amd64/amd64/pmap.c user/adrian/net80211_tx/sys/amd64/conf/GENERIC user/adrian/net80211_tx/sys/amd64/include/pmap.h user/adrian/net80211_tx/sys/arm/arm/locore.S user/adrian/net80211_tx/sys/arm/conf/RPI-B user/adrian/net80211_tx/sys/arm/econa/econa_machdep.c user/adrian/net80211_tx/sys/arm/include/vmparam.h user/adrian/net80211_tx/sys/arm/s3c2xx0/s3c24x0_machdep.c user/adrian/net80211_tx/sys/arm/xscale/i80321/ep80219_machdep.c user/adrian/net80211_tx/sys/arm/xscale/i80321/iq31244_machdep.c user/adrian/net80211_tx/sys/arm/xscale/i8134x/crb_machdep.c user/adrian/net80211_tx/sys/arm/xscale/ixp425/avila_machdep.c user/adrian/net80211_tx/sys/arm/xscale/pxa/pxa_machdep.c user/adrian/net80211_tx/sys/bsm/audit_kevents.h user/adrian/net80211_tx/sys/cddl/compat/opensolaris/sys/file.h user/adrian/net80211_tx/sys/cddl/compat/opensolaris/sys/kcondvar.h user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/common/zfs/zfs_ioctl_compat.c user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/common/zfs/zfs_ioctl_compat.h user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/common/zfs/zfs_prop.c user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_dataset.c user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dsl_dir.c user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/spa.c user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_onexit.c user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/uts/common/sys/fs/zfs.h user/adrian/net80211_tx/sys/compat/freebsd32/freebsd32_proto.h user/adrian/net80211_tx/sys/compat/freebsd32/freebsd32_syscall.h user/adrian/net80211_tx/sys/compat/freebsd32/freebsd32_syscalls.c user/adrian/net80211_tx/sys/compat/freebsd32/freebsd32_sysent.c user/adrian/net80211_tx/sys/compat/freebsd32/freebsd32_systrace_args.c user/adrian/net80211_tx/sys/compat/freebsd32/syscalls.master user/adrian/net80211_tx/sys/compat/linux/linux_file.c user/adrian/net80211_tx/sys/compat/ndis/kern_ndis.c user/adrian/net80211_tx/sys/compat/svr4/svr4_fcntl.c user/adrian/net80211_tx/sys/compat/svr4/svr4_filio.c user/adrian/net80211_tx/sys/compat/svr4/svr4_misc.c user/adrian/net80211_tx/sys/compat/svr4/svr4_stream.c user/adrian/net80211_tx/sys/conf/options.sparc64 user/adrian/net80211_tx/sys/dev/aac/aac.c user/adrian/net80211_tx/sys/dev/aac/aac_cam.c user/adrian/net80211_tx/sys/dev/aac/aac_disk.c user/adrian/net80211_tx/sys/dev/aac/aac_pci.c user/adrian/net80211_tx/sys/dev/aac/aac_tables.h user/adrian/net80211_tx/sys/dev/aac/aacvar.h user/adrian/net80211_tx/sys/dev/bce/if_bce.c user/adrian/net80211_tx/sys/dev/bce/if_bcereg.h user/adrian/net80211_tx/sys/dev/cas/if_cas.c user/adrian/net80211_tx/sys/dev/iscsi/initiator/iscsi.c user/adrian/net80211_tx/sys/dev/mfi/mfi.c user/adrian/net80211_tx/sys/dev/mps/mps.c user/adrian/net80211_tx/sys/dev/pci/pci.c user/adrian/net80211_tx/sys/dev/puc/pucdata.c user/adrian/net80211_tx/sys/dev/tws/tws_hdm.c user/adrian/net80211_tx/sys/fs/fdescfs/fdesc_vfsops.c user/adrian/net80211_tx/sys/fs/fdescfs/fdesc_vnops.c user/adrian/net80211_tx/sys/fs/nfs/nfsdport.h user/adrian/net80211_tx/sys/fs/nfsclient/nfs_clport.c user/adrian/net80211_tx/sys/fs/nfsserver/nfs_nfsdport.c user/adrian/net80211_tx/sys/fs/nullfs/null_vfsops.c user/adrian/net80211_tx/sys/geom/label/g_label_ntfs.c user/adrian/net80211_tx/sys/i386/conf/GENERIC user/adrian/net80211_tx/sys/i386/i386/pmap.c user/adrian/net80211_tx/sys/i386/ibcs2/ibcs2_misc.c user/adrian/net80211_tx/sys/i386/include/pmap.h user/adrian/net80211_tx/sys/i386/xen/pmap.c user/adrian/net80211_tx/sys/kern/capabilities.conf user/adrian/net80211_tx/sys/kern/init_sysent.c user/adrian/net80211_tx/sys/kern/kern_descrip.c user/adrian/net80211_tx/sys/kern/kern_exec.c user/adrian/net80211_tx/sys/kern/kern_exit.c user/adrian/net80211_tx/sys/kern/kern_fork.c user/adrian/net80211_tx/sys/kern/kern_sysctl.c user/adrian/net80211_tx/sys/kern/kern_timeout.c user/adrian/net80211_tx/sys/kern/subr_sleepqueue.c user/adrian/net80211_tx/sys/kern/subr_trap.c user/adrian/net80211_tx/sys/kern/sys_capability.c user/adrian/net80211_tx/sys/kern/sys_generic.c user/adrian/net80211_tx/sys/kern/syscalls.c user/adrian/net80211_tx/sys/kern/syscalls.master user/adrian/net80211_tx/sys/kern/systrace_args.c user/adrian/net80211_tx/sys/kern/tty.c user/adrian/net80211_tx/sys/kern/uipc_domain.c user/adrian/net80211_tx/sys/kern/uipc_mqueue.c user/adrian/net80211_tx/sys/kern/uipc_sem.c user/adrian/net80211_tx/sys/kern/uipc_shm.c user/adrian/net80211_tx/sys/kern/uipc_socket.c user/adrian/net80211_tx/sys/kern/uipc_syscalls.c user/adrian/net80211_tx/sys/kern/uipc_usrreq.c user/adrian/net80211_tx/sys/kern/vfs_aio.c user/adrian/net80211_tx/sys/kern/vfs_default.c user/adrian/net80211_tx/sys/kern/vfs_lookup.c user/adrian/net80211_tx/sys/kern/vfs_syscalls.c user/adrian/net80211_tx/sys/kern/vfs_vnops.c user/adrian/net80211_tx/sys/netpfil/ipfw/ip_fw_dynamic.c user/adrian/net80211_tx/sys/netsmb/smb_dev.c user/adrian/net80211_tx/sys/nfsserver/nfs_srvkrpc.c user/adrian/net80211_tx/sys/ofed/include/linux/file.h user/adrian/net80211_tx/sys/ofed/include/linux/timer.h user/adrian/net80211_tx/sys/security/audit/audit.h user/adrian/net80211_tx/sys/security/audit/audit_arg.c user/adrian/net80211_tx/sys/security/audit/audit_bsm.c user/adrian/net80211_tx/sys/security/audit/audit_private.h user/adrian/net80211_tx/sys/sparc64/pci/ofw_pcib.c user/adrian/net80211_tx/sys/sparc64/pci/psycho.c user/adrian/net80211_tx/sys/sparc64/pci/sbbc.c user/adrian/net80211_tx/sys/sparc64/sbus/sbus.c user/adrian/net80211_tx/sys/sys/capability.h user/adrian/net80211_tx/sys/sys/file.h user/adrian/net80211_tx/sys/sys/filedesc.h user/adrian/net80211_tx/sys/sys/namei.h user/adrian/net80211_tx/sys/sys/proc.h user/adrian/net80211_tx/sys/sys/protosw.h user/adrian/net80211_tx/sys/sys/rmlock.h user/adrian/net80211_tx/sys/sys/socket.h user/adrian/net80211_tx/sys/sys/socketvar.h user/adrian/net80211_tx/sys/sys/syscall.h user/adrian/net80211_tx/sys/sys/syscall.mk user/adrian/net80211_tx/sys/sys/sysproto.h user/adrian/net80211_tx/sys/sys/time.h user/adrian/net80211_tx/sys/sys/user.h user/adrian/net80211_tx/sys/vm/vm_mmap.c user/adrian/net80211_tx/sys/vm/vm_object.c user/adrian/net80211_tx/tools/regression/pjdfstest/Makefile user/adrian/net80211_tx/tools/regression/pjdfstest/pjdfstest.c user/adrian/net80211_tx/tools/regression/security/cap_test/cap_test_capabilities.c user/adrian/net80211_tx/tools/regression/security/cap_test/cap_test_relative.c user/adrian/net80211_tx/usr.bin/kdump/kdump.c user/adrian/net80211_tx/usr.bin/kdump/mksubr user/adrian/net80211_tx/usr.bin/procstat/procstat_files.c user/adrian/net80211_tx/usr.sbin/pc-sysinstall/backend/functions-extractimage.sh user/adrian/net80211_tx/usr.sbin/pc-sysinstall/backend/functions-parse.sh user/adrian/net80211_tx/usr.sbin/pc-sysinstall/backend/parseconfig.sh user/adrian/net80211_tx/usr.sbin/pc-sysinstall/examples/README Directory Properties: user/adrian/net80211_tx/ (props changed) user/adrian/net80211_tx/cddl/contrib/opensolaris/ (props changed) user/adrian/net80211_tx/cddl/contrib/opensolaris/cmd/zfs/ (props changed) user/adrian/net80211_tx/cddl/contrib/opensolaris/lib/libzfs/ (props changed) user/adrian/net80211_tx/contrib/openbsm/ (props changed) user/adrian/net80211_tx/lib/libc/ (props changed) user/adrian/net80211_tx/sbin/ (props changed) user/adrian/net80211_tx/sbin/ipfw/ (props changed) user/adrian/net80211_tx/share/man/man4/ (props changed) user/adrian/net80211_tx/sys/ (props changed) user/adrian/net80211_tx/sys/cddl/contrib/opensolaris/ (props changed) user/adrian/net80211_tx/sys/conf/ (props changed) user/adrian/net80211_tx/usr.bin/procstat/ (props changed) Modified: user/adrian/net80211_tx/ObsoleteFiles.inc ============================================================================== --- user/adrian/net80211_tx/ObsoleteFiles.inc Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/ObsoleteFiles.inc Sun Mar 3 10:05:15 2013 (r247707) @@ -38,6 +38,27 @@ # xargs -n1 | sort | uniq -d; # done +# 20130302: NTFS support removed +OLD_FILES+=usr/include/fs/ntfs/ntfs.h +OLD_FILES+=usr/include/fs/ntfs/ntfs_compr.h +OLD_FILES+=usr/include/fs/ntfs/ntfs_ihash.h +OLD_FILES+=usr/include/fs/ntfs/ntfs_inode.h +OLD_FILES+=usr/include/fs/ntfs/ntfs_subr.h +OLD_FILES+=usr/include/fs/ntfs/ntfs_vfsops.h +OLD_FILES+=usr/include/fs/ntfs/ntfsmount.h +OLD_DIRS+=usr/include/fs/ntfs +OLD_FILES+=usr/share/man/man8/mount_ntfs.8.gz +# 20130302: PORTALFS support removed +OLD_FILES+=usr/include/fs/portalfs/portal.h +OLD_DIRS+=usr/include/fs/portalfs +OLD_FILES+=usr/share/examples/portal/README +OLD_FILES+=usr/share/examples/portal/portal.conf +OLD_DIRS+=usr/share/examples/portal +OLD_FILES+=usr/share/man/man8/mount_portalfs.8.gz +# 20130302: CODAFS support removed +OLD_FILES+=usr/share/man/man4/coda.4.gz +# 20130302: XFS support removed +OLD_FILES+=usr/share/man/man5/xfs.5.gz # 20130116: removed long unused directories for .1aout section manpages OLD_FILES+=usr/share/man/en.ISO8859-1/man1aout OLD_FILES+=usr/share/man/en.UTF-8/man1aout Modified: user/adrian/net80211_tx/UPDATING ============================================================================== --- user/adrian/net80211_tx/UPDATING Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/UPDATING Sun Mar 3 10:05:15 2013 (r247707) @@ -26,6 +26,13 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 10 disable the most expensive debugging functionality run "ln -s 'abort:false,junk:false' /etc/malloc.conf".) +20130301: + The ctl device has been disabled in GENERIC for i386 and amd64. + This was done due to the extra memory being allocated at system + initialisation time by the ctl driver which was only used if + a CAM target device was created. This makes a FreeBSD system + unusable on 128MB or less of RAM. + 20130208: A new compression method (lz4) has been merged to -HEAD. Please refer to zpool-features(7) for more information. Modified: user/adrian/net80211_tx/cddl/contrib/opensolaris/cmd/zfs/zfs.8 ============================================================================== --- user/adrian/net80211_tx/cddl/contrib/opensolaris/cmd/zfs/zfs.8 Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/cddl/contrib/opensolaris/cmd/zfs/zfs.8 Sun Mar 3 10:05:15 2013 (r247707) @@ -526,6 +526,39 @@ if the snapshot has been marked for defe .Qq Nm Cm destroy -d command. Otherwise, the property is .Cm off . +.It Sy logicalreferenced +The amount of space that is +.Qq logically +accessible by this dataset. +See the +.Sy referenced +property. +The logical space ignores the effect of the +.Sy compression +and +.Sy copies +properties, giving a quantity closer to the amount of data that applications +see. +However, it does include space consumed by metadata. +.Pp +This property can also be referred to by its shortened column name, +.Sy lrefer . +.It Sy logicalused +The amount of space that is +.Qq logically +consumed by this dataset and all its descendents. +See the +.Sy used +property. +The logical space ignores the effect of the +.Sy compression +and +.Sy copies +properties, giving a quantity closer to the amount of data that applications +see. +.Pp +This property can also be referred to by its shortened column name, +.Sy lused . .It Sy mounted For file systems, indicates whether the file system is currently mounted. This property can be either Modified: user/adrian/net80211_tx/cddl/contrib/opensolaris/lib/libzfs/common/libzfs_impl.h ============================================================================== --- user/adrian/net80211_tx/cddl/contrib/opensolaris/lib/libzfs/common/libzfs_impl.h Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/cddl/contrib/opensolaris/lib/libzfs/common/libzfs_impl.h Sun Mar 3 10:05:15 2013 (r247707) @@ -24,6 +24,7 @@ * Copyright (c) 2011 Pawel Jakub Dawidek <pawel@dawidek.net>. * All rights reserved. * Copyright (c) 2011 by Delphix. All rights reserved. + * Copyright (c) 2013 Martin Matuska <mm@FreeBSD.org>. All rights reserved. */ #ifndef _LIBFS_IMPL_H @@ -216,6 +217,7 @@ extern void libzfs_fru_clear(libzfs_hand #ifndef sun static int zfs_kernel_version = 0; +static int zfs_ioctl_version = 0; /* * This is FreeBSD version of ioctl, because Solaris' ioctl() updates @@ -225,19 +227,34 @@ static int zfs_kernel_version = 0; static __inline int zcmd_ioctl(int fd, unsigned long cmd, zfs_cmd_t *zc) { - size_t oldsize, zfs_kernel_version_size; + size_t oldsize, zfs_kernel_version_size, zfs_ioctl_version_size; int version, ret, cflag = ZFS_CMD_COMPAT_NONE; - zfs_kernel_version_size = sizeof(zfs_kernel_version); - if (zfs_kernel_version == 0) { - sysctlbyname("vfs.zfs.version.spa", &zfs_kernel_version, - &zfs_kernel_version_size, NULL, 0); + zfs_ioctl_version_size = sizeof(zfs_ioctl_version); + if (zfs_ioctl_version == 0) { + sysctlbyname("vfs.zfs.version.ioctl", &zfs_ioctl_version, + &zfs_ioctl_version_size, NULL, 0); } - if (zfs_kernel_version == SPA_VERSION_15 || - zfs_kernel_version == SPA_VERSION_14 || - zfs_kernel_version == SPA_VERSION_13) - cflag = ZFS_CMD_COMPAT_V15; + /* + * If vfs.zfs.version.ioctl is not defined, assume we have v28 + * compatible binaries and use vfs.zfs.version.spa to test for v15 + */ + if (zfs_ioctl_version < ZFS_IOCVER_DEADMAN) { + cflag = ZFS_CMD_COMPAT_V28; + zfs_kernel_version_size = sizeof(zfs_kernel_version); + + if (zfs_kernel_version == 0) { + sysctlbyname("vfs.zfs.version.spa", + &zfs_kernel_version, + &zfs_kernel_version_size, NULL, 0); + } + + if (zfs_kernel_version == SPA_VERSION_15 || + zfs_kernel_version == SPA_VERSION_14 || + zfs_kernel_version == SPA_VERSION_13) + cflag = ZFS_CMD_COMPAT_V15; + } oldsize = zc->zc_nvlist_dst_size; ret = zcmd_ioctl_compat(fd, cmd, zc, cflag); Modified: user/adrian/net80211_tx/contrib/openbsm/etc/audit_event ============================================================================== --- user/adrian/net80211_tx/contrib/openbsm/etc/audit_event Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/contrib/openbsm/etc/audit_event Sun Mar 3 10:05:15 2013 (r247707) @@ -548,7 +548,7 @@ 43184:AUE_OPENAT:openat(2) - attr only:fa 43185:AUE_POSIX_OPENPT:posix_openpt(2):ip 43186:AUE_CAP_NEW:cap_new(2):fm -43187:AUE_CAP_GETRIGHTS:cap_getrights(2):fm +43187:AUE_CAP_RIGHTS_GET:cap_rights_get(2):fm 43188:AUE_CAP_ENTER:cap_enter(2):pc 43189:AUE_CAP_GETMODE:cap_getmode(2):pc 43190:AUE_POSIX_SPAWN:posix_spawn(2):pc @@ -563,6 +563,13 @@ 43199:AUE_PDGETPID:pdgetpid(2):pc 43200:AUE_PDWAIT:pdwait(2):pc 43201:AUE_WAIT6:wait6(2):pc +43202:AUE_CAP_RIGHTS_LIMIT:cap_rights_limit(2):fm +43203:AUE_CAP_IOCTLS_LIMIT:cap_ioctls_limit(2):fm +43204:AUE_CAP_IOCTLS_GET:cap_ioctls_get(2):fm +43205:AUE_CAP_FCNTLS_LIMIT:cap_fcntls_limit(2):fm +43206:AUE_CAP_FCNTLS_GET:cap_fcntls_get(2):fm +43207:AUE_BINDAT:bindat(2):nt +43208:AUE_CONNECTAT:connectat(2):nt # # Solaris userspace events. # Modified: user/adrian/net80211_tx/etc/devd.conf ============================================================================== --- user/adrian/net80211_tx/etc/devd.conf Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/etc/devd.conf Sun Mar 3 10:05:15 2013 (r247707) @@ -34,7 +34,7 @@ options { # NB: DETACH events are ignored; the kernel should handle all cleanup # (routes, arp cache). Beware of races against immediate create # of a device with the same name; e.g. -# ifconfig bridge0 destroy; ifconfig bridge0 create +# ifconfig bridge0 destroy; ifconfig bridge0 create # notify 0 { match "system" "IFNET"; @@ -165,7 +165,7 @@ notify 100 { }; # -# Rescan scsi device-names on attach, but not detach. However, it is +# Rescan SCSI device-names on attach, but not detach. However, it is # disabled by default due to reports of problems. # attach 0 { @@ -305,13 +305,13 @@ detach 10 { # events. See the ACPI specification for more information about # notifies. Here is the information returned for each subsystem: # -# ACAD: AC line state (0 is offline, 1 is online) -# Button: Button pressed (0 for power, 1 for sleep) -# CMBAT: ACPI battery events -# Lid: Lid state (0 is closed, 1 is open) -# RCTL: Resource limits +# ACAD: AC line state (0 is offline, 1 is online) +# Button: Button pressed (0 for power, 1 for sleep) +# CMBAT: ACPI battery events +# Lid: Lid state (0 is closed, 1 is open) +# RCTL: Resource limits # Suspend, Resume: Suspend and resume notification -# Thermal: ACPI thermal zone events +# Thermal: ACPI thermal zone events # # This example calls a script when the AC state changes, passing the # notify value as the first argument. If the state is 0x00, it might Modified: user/adrian/net80211_tx/lib/libc/gen/Makefile.inc ============================================================================== --- user/adrian/net80211_tx/lib/libc/gen/Makefile.inc Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/lib/libc/gen/Makefile.inc Sun Mar 3 10:05:15 2013 (r247707) @@ -16,6 +16,7 @@ SRCS+= __getosreldate.c \ assert.c \ auxv.c \ basename.c \ + cap_sandboxed.c \ check_utility_compat.c \ clock.c \ clock_getcpuclockid.c \ @@ -168,6 +169,7 @@ SYM_MAPS+=${.CURDIR}/gen/Symbol.map MAN+= alarm.3 \ arc4random.3 \ basename.3 \ + cap_sandboxed.3 \ check_utility_compat.3 \ clock.3 \ clock_getcpuclockid.3 \ Copied: user/adrian/net80211_tx/lib/libc/gen/cap_sandboxed.3 (from r247706, head/lib/libc/gen/cap_sandboxed.3) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ user/adrian/net80211_tx/lib/libc/gen/cap_sandboxed.3 Sun Mar 3 10:05:15 2013 (r247707, copy of r247706, head/lib/libc/gen/cap_sandboxed.3) @@ -0,0 +1,70 @@ +.\" Copyright (c) 2012 The FreeBSD Foundation +.\" All rights reserved. +.\" +.\" This documentation was written by Pawel Jakub Dawidek under sponsorship +.\" from the FreeBSD Foundation. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd September 18, 2012 +.Dt CAP_SANDBOXED 3 +.Os +.Sh NAME +.Nm cap_sandboxed +.Nd Check if in a capability mode sandbox +.Sh LIBRARY +.Lb libc +.Sh SYNOPSIS +.In sys/capability.h +.In stdbool.h +.Ft bool +.Fn cap_sandboxed "void" +.Sh DESCRIPTION +.Fn cap_sandboxed +returns +.Va true +if the process is in a capability mode sandbox or +.Va false +if it is not. +This function is a more handy alternative to the +.Xr cap_getmode 2 +system call as it always succeeds, so there is no need for error checking. +If the support for capability mode is not compiled into the kernel, +.Fn cap_sandboxed +will always return +.Va false . +.Sh RETURN VALUES +Function +.Fn cap_sandboxed +is always successful and will return either +.Va true +or +.Va false . +.Sh SEE ALSO +.Xr cap_enter 2 , +.Xr capsicum 4 +.Sh AUTHORS +This function was implemented and manual page was written by +.An Pawel Jakub Dawidek Aq pawel@dawidek.net +under sponsorship of the FreeBSD Foundation. Copied: user/adrian/net80211_tx/lib/libc/gen/cap_sandboxed.c (from r247706, head/lib/libc/gen/cap_sandboxed.c) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ user/adrian/net80211_tx/lib/libc/gen/cap_sandboxed.c Sun Mar 3 10:05:15 2013 (r247707, copy of r247706, head/lib/libc/gen/cap_sandboxed.c) @@ -0,0 +1,50 @@ +/*- + * Copyright (c) 2012 The FreeBSD Foundation + * All rights reserved. + * + * This software was developed by Pawel Jakub Dawidek under sponsorship from + * the FreeBSD Foundation. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include <sys/cdefs.h> +__FBSDID("$FreeBSD$"); + +#include <sys/capability.h> + +#include <assert.h> +#include <errno.h> +#include <stdbool.h> + +bool +cap_sandboxed(void) +{ + u_int mode; + + if (cap_getmode(&mode) != 0) { + assert(errno == ENOSYS); + return (false); + } + assert(mode == 0 || mode == 1); + return (mode == 1); +} Modified: user/adrian/net80211_tx/lib/libc/include/compat.h ============================================================================== --- user/adrian/net80211_tx/lib/libc/include/compat.h Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/lib/libc/include/compat.h Sun Mar 3 10:05:15 2013 (r247707) @@ -42,6 +42,8 @@ __sym_compat(__semctl, freebsd7___semctl __sym_compat(msgctl, freebsd7_msgctl, FBSD_1.0); __sym_compat(shmctl, freebsd7_shmctl, FBSD_1.0); +__sym_compat(cap_getrights, cap_rights_get, FBSD_1.2); + #undef __sym_compat #endif /* __LIBC_COMPAT_H__ */ Modified: user/adrian/net80211_tx/lib/libc/regex/regcomp.c ============================================================================== --- user/adrian/net80211_tx/lib/libc/regex/regcomp.c Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/lib/libc/regex/regcomp.c Sun Mar 3 10:05:15 2013 (r247707) @@ -1212,7 +1212,7 @@ CHaddrange(struct parse *p, cset *cs, wi } cs->ranges = newranges; cs->ranges[cs->nranges].min = min; - cs->ranges[cs->nranges].min = max; + cs->ranges[cs->nranges].max = max; cs->nranges++; } Modified: user/adrian/net80211_tx/lib/libc/rpc/clnt_vc.c ============================================================================== --- user/adrian/net80211_tx/lib/libc/rpc/clnt_vc.c Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/lib/libc/rpc/clnt_vc.c Sun Mar 3 10:05:15 2013 (r247707) @@ -260,7 +260,7 @@ clnt_vc_create(fd, raddr, prog, vers, se if (ct->ct_addr.buf == NULL) goto err; memcpy(ct->ct_addr.buf, raddr->buf, raddr->len); - ct->ct_addr.len = raddr->maxlen; + ct->ct_addr.len = raddr->len; ct->ct_addr.maxlen = raddr->maxlen; /* Modified: user/adrian/net80211_tx/lib/libc/sys/Makefile.inc ============================================================================== --- user/adrian/net80211_tx/lib/libc/sys/Makefile.inc Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/lib/libc/sys/Makefile.inc Sun Mar 3 10:05:15 2013 (r247707) @@ -91,9 +91,12 @@ MAN+= abort2.2 \ aio_waitcomplete.2 \ aio_write.2 \ bind.2 \ + bindat.2 \ brk.2 \ cap_enter.2 \ - cap_new.2 \ + cap_fcntls_limit.2 \ + cap_ioctls_limit.2 \ + cap_rights_limit.2 \ chdir.2 \ chflags.2 \ chmod.2 \ @@ -103,6 +106,7 @@ MAN+= abort2.2 \ close.2 \ closefrom.2 \ connect.2 \ + connectat.2 \ cpuset.2 \ cpuset_getaffinity.2 \ dup.2 \ @@ -270,7 +274,9 @@ MLINKS+=access.2 eaccess.2 \ access.2 faccessat.2 MLINKS+=brk.2 sbrk.2 MLINKS+=cap_enter.2 cap_getmode.2 -MLINKS+=cap_new.2 cap_getrights.2 +MLINKS+=cap_fcntls_limit.2 cap_fcntls_get.2 +MLINKS+=cap_ioctls_limit.2 cap_ioctls_get.2 +MLINKS+=cap_rights_limit.2 cap_rights_get.2 MLINKS+=chdir.2 fchdir.2 MLINKS+=chflags.2 fchflags.2 \ chflags.2 lchflags.2 Modified: user/adrian/net80211_tx/lib/libc/sys/Symbol.map ============================================================================== --- user/adrian/net80211_tx/lib/libc/sys/Symbol.map Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/lib/libc/sys/Symbol.map Sun Mar 3 10:05:15 2013 (r247707) @@ -364,7 +364,6 @@ FBSD_1.2 { cap_enter; cap_getmode; cap_new; - cap_getrights; getloginclass; pdfork; pdgetpid; @@ -379,7 +378,16 @@ FBSD_1.2 { }; FBSD_1.3 { + bindat; + cap_fcntls_get; + cap_fcntls_limit; + cap_ioctls_get; + cap_ioctls_limit; + cap_rights_get; + cap_rights_limit; + cap_sandboxed; clock_getcpuclockid2; + connectat; ffclock_getcounter; ffclock_getestimate; ffclock_setestimate; Copied: user/adrian/net80211_tx/lib/libc/sys/bindat.2 (from r247706, head/lib/libc/sys/bindat.2) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ user/adrian/net80211_tx/lib/libc/sys/bindat.2 Sun Mar 3 10:05:15 2013 (r247707, copy of r247706, head/lib/libc/sys/bindat.2) @@ -0,0 +1,109 @@ +.\" Copyright (c) 2013 The FreeBSD Foundation +.\" All rights reserved. +.\" +.\" This documentation was written by Pawel Jakub Dawidek under sponsorship from +.\" the FreeBSD Foundation. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd February 13, 2013 +.Dt BINDAT 2 +.Os +.Sh NAME +.Nm bindat +.Nd assign a local protocol address to a socket +.Sh LIBRARY +.Lb libc +.Sh SYNOPSIS +.In sys/types.h +.In sys/socket.h +.Pp +.In fcntl.h +.Ft int +.Fn bindat "int fd" "int s" "const struct sockaddr *addr" "socklen_t addrlen" +.Sh DESCRIPTION +The +.Fn bindat +system call assigns the local protocol address to a socket. +It works just like the +.Xr bind 2 +system call with two exceptions: +.Pp +.Bl -enum -offset indent -compact +.It +It is limited to sockets in the PF_LOCAL domain. +.Pp +.It +If the file path stored in the +.Fa sun_path +field of the sockaddr_un structure is a relative path, it is located relative +to the directory associated with the file descriptor +.Fa fd . +If +.Fn bindat +is passed the special value +.Dv AT_FDCWD +in the +.Fa fd +parameter, the current working directory is used and the behavior is identical +to a call to +.Xr bind 2 . +.El +.Sh RETURN VALUES +.Rv -std bindat +.Sh ERRORS +The +.Fn bindat +system call may fail with the same errors as the +.Xr bind 2 +system call for a UNIX domain socket or with the following errors: +.Bl -tag -width Er +.It Bq Er EBADF +The +.Fa sun_path +field does not specify an absolute path and the +.Fa fd +argument is neither +.Dv AT_FDCWD +nor a valid file descriptor. +.It Bq Er ENOTDIR +The +.Fa sun_path +field is not an absolute path and +.Fa fd +is neither +.Dv AT_FDCWD +nor a file descriptor associated with a directory. +.El +.Sh SEE ALSO +.Xr bind 2 , +.Xr connectat 2 , +.Xr socket 2 , +.Xr unix 4 +.Sh AUTHORS +The +.Nm +was developed by +.An Pawel Jakub Dawidek Aq pawel@dawidek.net +under sponsorship from the FreeBSD Foundation. Modified: user/adrian/net80211_tx/lib/libc/sys/cap_enter.2 ============================================================================== --- user/adrian/net80211_tx/lib/libc/sys/cap_enter.2 Sun Mar 3 10:02:08 2013 (r247706) +++ user/adrian/net80211_tx/lib/libc/sys/cap_enter.2 Sun Mar 3 10:05:15 2013 (r247707) @@ -58,8 +58,10 @@ or .Xr pdfork 2 will be placed in capability mode from inception. .Pp -When combined with capabilities created with -.Xr cap_new 2 , +When combined with +.Xr cap_rights_limit 2 , +.Xr cap_ioctls_limit 2 , +.Xr cap_fcntls_limit 2 , .Fn cap_enter may be used to create kernel-enforced sandboxes in which appropriately-crafted applications or application components may be run. @@ -71,11 +73,6 @@ sandbox. Creating effective process sandboxes is a tricky process that involves identifying the least possible rights required by the process and then passing those rights into the process in a safe manner. -See the CAVEAT -section of -.Xr cap_new 2 -for why this is particularly tricky with UNIX file descriptors as the -canonical representation of a right. Consumers of .Fn cap_enter should also be aware of other inherited rights, such as access to VM @@ -87,9 +84,35 @@ to create a runtime environment inside t acquired rights as possible. .Sh RETURN VALUES .Rv -std cap_enter cap_getmode +.Sh ERRORS +The +.Fn cap_enter +and +.Fn cap_getmode +system calls +will fail if: +.Bl -tag -width Er +.It Bq Er ENOSYS +The kernel is compiled without: +.Pp +.Cd "options CAPABILITY_MODE" +.El +.Pp +The +.Fn cap_getmode +system call may also return the following error: +.Bl -tag -width Er +.It Bq Er EFAULT +Pointer +.Fa modep +points outside the process's allocated address space. +.El .Sh SEE ALSO -.Xr cap_new 2 , +.Xr cap_fcntls_limit 2 , +.Xr cap_ioctls_limit 2 , +.Xr cap_rights_limit 2 , .Xr fexecve 2 , +.Xr cap_sandboxed 3 , .Xr capsicum 4 .Sh HISTORY Support for capabilities and capabilities mode was developed as part of the Copied: user/adrian/net80211_tx/lib/libc/sys/cap_fcntls_limit.2 (from r247706, head/lib/libc/sys/cap_fcntls_limit.2) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ user/adrian/net80211_tx/lib/libc/sys/cap_fcntls_limit.2 Sun Mar 3 10:05:15 2013 (r247707, copy of r247706, head/lib/libc/sys/cap_fcntls_limit.2) @@ -0,0 +1,126 @@ +.\" +.\" Copyright (c) 2012 The FreeBSD Foundation +.\" All rights reserved. +.\" +.\" This documentation was written by Pawel Jakub Dawidek under sponsorship +.\" the FreeBSD Foundation. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd September 20, 2012 +.Dt CAP_FCNTLS_LIMIT 2 +.Os +.Sh NAME +.Nm cap_fcntls_limit , +.Nm cap_fcntls_get +.Nd manage allowed fcntl commands +.Sh LIBRARY +.Lb libc +.Sh SYNOPSIS +.In sys/capability.h +.Ft int +.Fn cap_fcntls_limit "int fd" "uint32_t fcntlrights" +.Ft int +.Fn cap_fcntls_get "int fd" "uint32_t *fcntlrightsp" +.Sh DESCRIPTION +If a file descriptor is granted the +.Dv CAP_FCNTL +capability right, the list of allowed +.Xr fcntl 2 +commands can be selectively reduced (but never expanded) with the +.Fn cap_fcntls_limit +system call. +.Pp +A bitmask of allowed fcntls commands for a given file descriptor can be obtained +with the +.Fn cap_fcntls_get +system call. +.Sh FLAGS +The following flags may be specified in the +.Fa fcntlrights +argument or returned in the +.Fa fcntlrightsp +argument: +.Bl -tag -width CAP_FCNTL_GETOWN +.It Dv CAP_FCNTL_GETFL +Permit +.Dv F_GETFL +command. +.It Dv CAP_FCNTL_SETFL +Permit +.Dv F_SETFL +command. +.It Dv CAP_FCNTL_GETOWN +Permit +.Dv F_GETOWN +command. +.It Dv CAP_FCNTL_SETOWN +Permit +.Dv F_SETOWN +command. +.El +.Sh RETURN VALUES +.Rv -std +.Sh ERRORS +.Fn cap_fcntls_limit +succeeds unless: +.Bl -tag -width Er +.It Bq Er EBADF +The +.Fa fd +argument is not a valid descriptor. +.It Bq Er EINVAL +An invalid flag has been passed in +.Fa fcntlrights . +.It Bq Er ENOTCAPABLE +.Fa fcntlrights +would expand the list of allowed +.Xr fcntl 2 +commands. +.El +.Pp +.Fn cap_fcntls_get +succeeds unless: +.Bl -tag -width Er +.It Bq Er EBADF +The +.Fa fd +argument is not a valid descriptor. +.It Bq Er EFAULT +The +.Fa fcntlrightsp +argument points at an invalid address. +.El +.Sh SEE ALSO +.Xr cap_ioctls_limit 2 , +.Xr cap_rights_limit 2 , +.Xr fcntl 2 +.Sh HISTORY +Support for capabilities and capabilities mode was developed as part of the +.Tn TrustedBSD +Project. +.Sh AUTHORS +This function was created by +.An Pawel Jakub Dawidek Aq pawel@dawidek.net +under sponsorship of the FreeBSD Foundation. Copied: user/adrian/net80211_tx/lib/libc/sys/cap_ioctls_limit.2 (from r247706, head/lib/libc/sys/cap_ioctls_limit.2) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ user/adrian/net80211_tx/lib/libc/sys/cap_ioctls_limit.2 Sun Mar 3 10:05:15 2013 (r247707, copy of r247706, head/lib/libc/sys/cap_ioctls_limit.2) @@ -0,0 +1,157 @@ +.\" +.\" Copyright (c) 2012 The FreeBSD Foundation +.\" All rights reserved. +.\" +.\" This documentation was written by Pawel Jakub Dawidek under sponsorship +.\" the FreeBSD Foundation. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd September 20, 2012 +.Dt CAP_IOCTLS_LIMIT 2 +.Os +.Sh NAME +.Nm cap_ioctls_limit , +.Nm cap_ioctls_get +.Nd manage allowed ioctl commands +.Sh LIBRARY +.Lb libc +.Sh SYNOPSIS +.In sys/capability.h +.Ft int +.Fn cap_ioctls_limit "int fd" "const unsigned long *cmds" "size_t ncmds" +.Ft ssize_t +.Fn cap_ioctls_get "int fd" "unsigned long *cmds" "size_t maxcmds" +.Sh DESCRIPTION +If a file descriptor is granted the +.Dv CAP_IOCTL +capability right, the list of allowed +.Xr ioctl 2 +commands can be selectively reduced (but never expanded) with the +.Fn cap_ioctls_limit +system call. +The +.Fa cmds +argument is an array of +.Xr ioctl 2 +commands and the +.Fa ncmds +argument specifies the number of elements in the array. +There might be up to +.Va 256 +elements in the array. +.Pp +The list of allowed ioctl commands for a given file descriptor can be obtained +with the +.Fn cap_ioctls_get +system call. +The +.Fa cmds +argument points at memory that can hold up to +.Fa maxcmds +values. +The function populates the provided buffer with up to +.Fa maxcmds +elements, but always returns the total number of ioctl commands allowed for the +given file descriptor. +The total number of ioctls commands for the given file descriptor can be +obtained by passing +.Dv NULL as the +.Fa cmds +argument and +.Va 0 +as the +.Fa maxcmds +argument. +If all ioctl commands are allowed +.Dv ( CAP_IOCTL +capability right is assigned to the file descriptor and the +.Fn cap_ioctls_limit +system call was never called for this file descriptor), the +.Fn cap_ioctls_get +system call will return +.Dv CAP_IOCTLS_ALL +and won't modify the buffer pointed out by the +.Fa cmds +argument. +.Sh RETURN VALUES +.Rv -std cap_ioctls_limit +.Pp +The +.Fn cap_ioctls_limit +function, if successfull, returns the total number of allowed ioctl commands or +the value +.Dv INT_MAX +if all ioctls commands are allowed. +On failure the value +.Va -1 +is returned and the global variable errno is set to indicate the error. +.Sh ERRORS +.Fn cap_ioctls_limit +succeeds unless: +.Bl -tag -width Er +.It Bq Er EBADF +The +.Fa fd +argument is not a valid descriptor. +.It Bq Er EFAULT +The +.Fa cmds +argument points at an invalid address. +.It Bq Er EINVAL +The +.Fa ncmds +argument is greater than +.Va 256 . +.It Bq Er ENOTCAPABLE +.Fa cmds +would expand the list of allowed +.Xr ioctl 2 +commands. +.El +.Pp +.Fn cap_ioctls_get +succeeds unless: +.Bl -tag -width Er +.It Bq Er EBADF +The +.Fa fd +argument is not a valid descriptor. +.It Bq Er EFAULT +The +.Fa cmds +argument points at invalid address. +.El +.Sh SEE ALSO +.Xr cap_fcntls_limit 2 , +.Xr cap_rights_limit 2 , +.Xr ioctl 2 +.Sh HISTORY +Support for capabilities and capabilities mode was developed as part of the +.Tn TrustedBSD +Project. +.Sh AUTHORS +This function was created by +.An Pawel Jakub Dawidek Aq pawel@dawidek.net +under sponsorship of the FreeBSD Foundation. Copied: user/adrian/net80211_tx/lib/libc/sys/cap_rights_limit.2 (from r247706, head/lib/libc/sys/cap_rights_limit.2) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ user/adrian/net80211_tx/lib/libc/sys/cap_rights_limit.2 Sun Mar 3 10:05:15 2013 (r247707, copy of r247706, head/lib/libc/sys/cap_rights_limit.2) @@ -0,0 +1,612 @@ +.\" +.\" Copyright (c) 2008-2010 Robert N. M. Watson +.\" Copyright (c) 2012-2013 The FreeBSD Foundation +.\" All rights reserved. +.\" +.\" This software was developed at the University of Cambridge Computer +.\" Laboratory with support from a grant from Google, Inc. +.\" +.\" Portions of this documentation were written by Pawel Jakub Dawidek +.\" under sponsorship from the FreeBSD Foundation. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd February 23, 2013 +.Dt CAP_RIGHTS_LIMIT 2 +.Os +.Sh NAME +.Nm cap_rights_limit , +.Nm cap_rights_get +.Nd manage capability rights +.Sh LIBRARY +.Lb libc +.Sh SYNOPSIS +.In sys/capability.h +.Ft int +.Fn cap_rights_limit "int fd" "cap_rights_t rights" +.Ft int +.Fn cap_rights_get "int fd" "cap_rights_t *rightsp" +.Sh DESCRIPTION +When a file descriptor is created by a function such as +.Xr fhopen 2 , +.Xr kqueue 2 , +.Xr mq_open 2 , +.Xr open 2 , +.Xr openat 2 , +.Xr pdfork 2 , +.Xr pipe 2 , +.Xr shm_open 2 , +.Xr socket 2 , +or +.Xr socketpair 2 , +it is assigned all capability rights. +Those rights can be reduced (but never expanded) by using the +.Fn cap_rights_limit +system call. +Once capability rights are reduced, operations on the file descriptor will be +limited to those permitted by +.Fa rights . +.Pp +A bitmask of capability rights assigned to a file descriptor can be obtained with +the +.Fn cap_rights_get +system call. +.Sh RIGHTS +The following rights may be specified in a rights mask: +.Bl -tag -width CAP_EXTATTR_DELETE +.It Dv CAP_ACCEPT *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201303031005.r23A5G9t083112>