Differential D58082
jail: Add Capsicum rights for jail descriptor operations Authored by me_runxiyu.org on Jul 7 2026, 11:45 AM.
Details Add CAP_JAIL_ATTACH, CAP_JAIL_REMOVE, and CAP_JAIL_SET, Note that that rights are attenuated according to creds Co-authored-by: Runxi Yu <runxiyu@umich.edu>
Diff Detail
Event TimelineComment Actions Was supposed to be this. Not sure how differential works here, can't seem to specify the author properly... commit 331611bc3800182657afdaad4e069c084fa13865 tree aa2019becd28867737bb8a9c46528bd4c2afe1f8 parent 4efbcf36a0d49ab142023a767871532f515f1381 author Kory Heard <koryheard@icloud.com> 1783193821 +0000 committer Runxi Yu <me@runxiyu.org> 1783243333 +0000 jail: Add Capsicum rights for jail descriptor operations Add CAP_JAIL_ATTACH, CAP_JAIL_REMOVE, and CAP_JAIL_SET, and use them when JAIL_USE_DESC on jail_attach_jd(2), jail_remove_jd(2), and jail_set(2). Note that that rights are attenuated according to creds at descriptor creation. Co-authored-by: Runxi Yu <runxiyu@umich.edu> Comment Actions Adding jail folks; this is an extension of ttps://github.com/freebsd/freebsd-src/pull/2108. At least one notable change since @jamie looked last is that we negotiated dropping the rights(4) at creation time, so use of the descriptor can check just the rights(4) rather than both rights + jdcred/fp->f_cred. Looking back at Jamie's feedback from the PR, it may make sense to add CAP_JAIL_GET up front. He also mentioned some sysctl improvements for capabilitiy mode, but this could be a follow-up change. |