Page MenuHomeFreeBSD

capsicum_helpers: split stream cap bits out of caph_limit_stream()
ClosedPublic

Authored by kevans on Jan 1 2020, 8:53 PM.

Details

Summary

The goal here is to make it so applications can take the rights one would normally get by calling caph_limit_stream() on a descriptor and build on them as needed.

My current use-case is inetd, where the control socket's rights will be caph_stream_rights() + ACCEPT/BIND/LISTEN/SETSOCKOPT, and once a client connects we limit those sockets further to caph_stream_rights() + SETSOCKOPT. inetd must at least use a superset of caph_stream_rights in case invoked program leads to caph_limit_stdio(), which is quite common. I *think* this is a feasible approach, at least.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Lint Skipped
Unit
Unit Tests Skipped
Build Status
Buildable 28444

Event Timeline

kevans created this revision.Jan 1 2020, 8:53 PM
markj accepted this revision.Jan 2 2020, 2:41 PM

This seems ok to me. Shouldn't caph_stream_rights() be documented?

It might also be nice to have a caph_limit_stream_rights() or whatever which uses a caller-supplied rights set and limits ioctls like caph_limit_stream() does. I'm not sure if that's really useful though.

lib/libcapsicum/capsicum_helpers.h
51–56

I think the backslash is not needed.

This revision is now accepted and ready to land.Jan 2 2020, 2:41 PM
oshogbo accepted this revision.Jan 2 2020, 7:20 PM

LGTM.
Like @markj mentioned please add it to man page.

kevans updated this revision to Diff 66267.Jan 2 2020, 9:30 PM
kevans marked an inline comment as done.

Amend capsicum_helpers(3) and remove useless escape.

This revision now requires review to proceed.Jan 2 2020, 9:30 PM
markj accepted this revision.Jan 2 2020, 10:36 PM
This revision is now accepted and ready to land.Jan 2 2020, 10:36 PM