Differential D15637 Diff 43215 sys/kern/capabilities.conf

Changeset View

Standalone View

sys/kern/capabilities.conf

	Show All 23 Lines
	## HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT			## HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	## LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY			## LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	## OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF			## OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	## SUCH DAMAGE.			## SUCH DAMAGE.
	##			##
	## List of system calls enabled in capability mode, one name per line.			## List of system calls enabled in capability mode, one name per line.
	##			##
	## Notes:			## Notes:
	## - sys_exit(2), abort2(2) and close(2) are very important.			## - exit(2), abort2(2) and close(2) are very important.
				kibUnsubmitted Not Done Inline Actions What about compat/freebsd32/capabilities.conf ? kib: What about compat/freebsd32/capabilities.conf ?
	## - Sorted alphabetically, please keep it that way.			## - Sorted alphabetically, please keep it that way.
	##			##
	## $FreeBSD$			## $FreeBSD$
	##			##

	##			##
	## Allow ACL and MAC label operations by file descriptor, subject to			## Allow ACL and MAC label operations by file descriptor, subject to
	## capability rights. Allow MAC label operations on the current process but			## capability rights. Allow MAC label operations on the current process but
	▲ Show 20 Lines • Show All 640 Lines • ▼ Show 20 Lines
	sstk			sstk

	##			##
	## Do allow sync(2) for now, but possibly shouldn't.			## Do allow sync(2) for now, but possibly shouldn't.
	##			##
	sync			sync

	##			##
	## Always allow process termination with sys_exit(2).			## Always allow process termination with exit(2).
	##			##
	sys_exit			exit

	##			##
	## sysarch(2) does rather diverse things, but is required on at least i386			## sysarch(2) does rather diverse things, but is required on at least i386
	## in order to configure per-thread data. As such, it's scoped on each			## in order to configure per-thread data. As such, it's scoped on each
	## architecture.			## architecture.
	##			##
	sysarch			sysarch

	▲ Show 20 Lines • Show All 48 Lines • Show Last 20 Lines