diff --git a/lib/libc/sys/open.2 b/lib/libc/sys/open.2 --- a/lib/libc/sys/open.2 +++ b/lib/libc/sys/open.2 @@ -572,12 +572,6 @@ .Dv O_EXEC or .Dv O_SEARCH . -.It Bq Er EINVAL -The -.Dv O_RESOLVE_BENEATH -flag is specified and -.Dv path -is absolute. .It Bq Er EBADF The .Fa path @@ -606,19 +600,32 @@ was called and the process is in capability mode. .It Bq Er ENOTCAPABLE .Fa path -is an absolute path, -or contained a ".." component leading to a -directory outside of the directory hierarchy specified by -.Fa fd , +is an absolute path and the process is in capability mode. +.It Bq Er ENOTCAPABLE +.Fa path +is an absolute path and +.Dv O_RESOLVE_BENEATH +is specified. +.It Bq Er ENOTCAPABLE +.Fa path +contained a ".." component leading to a directory outside +of the directory hierarchy specified by +.Fa fd and the process is in capability mode. .It Bq Er ENOTCAPABLE -The -.Dv O_RESOLVE_BENEATH -flag was provided, and the relative .Fa path -escapes the -.Ar fd -directory. +contained a ".." component leading to a directory outside +of the directory hierarchy specified by +.Fa fd +and +.Dv O_RESOLVE_BENEATH +is specified. +.It Bq Er ENOTCAPABLE +.Fa path +contained a ".." component, the +.Dv vfs.lookup_cap_dotdot +.Xr sysctl 3 +is set, and the process is in capability mode. .El .Sh SEE ALSO .Xr chmod 2 ,