diff --git a/lib/libcasper/libcasper/libcasper.3 b/lib/libcasper/libcasper/libcasper.3 index c08ea0f21f8b..02c08270dcf2 100644 --- a/lib/libcasper/libcasper/libcasper.3 +++ b/lib/libcasper/libcasper/libcasper.3 @@ -1,297 +1,298 @@ .\" Copyright (c) 2013 The FreeBSD Foundation .\" Copyright (c) 2018 Mariusz Zaborski .\" All rights reserved. .\" .\" This documentation was written by Pawel Jakub Dawidek under sponsorship .\" from the FreeBSD Foundation. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" $FreeBSD$ .\" -.Dd January 3, 2021 +.Dd November 15, 2021 .Dt LIBCASPER 3 .Os .Sh NAME .Nm cap_init , .Nm cap_wrap , .Nm cap_unwrap , .Nm cap_sock , .Nm cap_clone , .Nm cap_close , .Nm cap_limit_get , .Nm cap_limit_set , .Nm cap_send_nvlist , .Nm cap_recv_nvlist , .Nm cap_xfer_nvlist , .Nm cap_service_open .Nd "library for handling application capabilities" .Sh LIBRARY .Lb libcasper .Sh SYNOPSIS .Fd #define WITH_CASPER .In sys/nv.h .In libcasper.h .Ft "cap_channel_t *" .Fn cap_init "void" .Ft "cap_channel_t *" .Fn cap_wrap "int sock" "int flags" .Ft "int" .Fn cap_unwrap "cap_channel_t *chan" "int *flags" .Ft "int" .Fn cap_sock "const cap_channel_t *chan" .Ft "cap_channel_t *" .Fn cap_clone "const cap_channel_t *chan" .Ft "void" .Fn cap_close "cap_channel_t *chan" .Ft "int" .Fn cap_limit_get "const cap_channel_t *chan" "nvlist_t **limitsp" .Ft "int" .Fn cap_limit_set "const cap_channel_t *chan" "nvlist_t *limits" .Ft "int" .Fn cap_send_nvlist "const cap_channel_t *chan" "const nvlist_t *nvl" .Ft "nvlist_t *" .Fn cap_recv_nvlist "const cap_channel_t *chan" .Ft "nvlist_t *" .Fn cap_xfer_nvlist "const cap_channel_t *chan" "nvlist_t *nvl" .Ft "cap_channel_t *" .Fn cap_service_open "const cap_channel_t *chan" "const char *name" .Sh DESCRIPTION The .Nm libcasper -library provides for the control of application capabilities through the casper process. +library provides for the control of application capabilities through +the casper process. .Pp An application capability, represented by the .Vt cap_channel_t type, is a communication channel between the caller and the casper daemon or an instance of one of the daemon's services. A capability to the casper process, obtained with the .Fn cap_init -function, allows a program to create capabilities to acacce +function, allows a program to create capabilities to access the casper daemon's services via the .Fn cap_service_open function. .Pp The .Fn cap_init function instantiates a capability to allow a program to access the casper daemon. .Pp The .Fn cap_wrap function creates a .Vt cap_channel_t based on the socket supplied in the call. The function is used when a capability is inherited through the .Xr execve 2 system call, or sent over a .Xr unix 4 domain socket as a file descriptor, -nd has to be converted into a +and has to be converted into a .Vt cap_channel_t . The .Fa flags argument defines the channel behavior. The supported flags are: .Bl -ohang -offset indent .It CASPER_NO_UNIQ -The communication between the process and the casper daemon no unique version of nvlist. +The communication between the process and the casper daemon no +unique version of nvlist. .El .Pp The .Fn cap_unwrap function returns the .Xr unix 4 -domain socket that was provided to the -.Fn cap_wrap -function, +domain socket used by the daemon service, and frees the .Vt cap_channel_t structure. .Pp The .Fn cap_clone function returns a clone of the capability passed as its only argument. .Pp The .Fn cap_close function closes, and frees, the given capability. .Pp The .Fn cap_sock function returns the .Xr unix 4 domain socket descriptor associated with the given capability for use with system calls such as: .Xr kevent 2 , .Xr poll 2 and .Xr select 2 . .Pp The .Fn cap_limit_get function stores the current limits of the given capability in the .Fa limitsp argument. If the function returns .Va 0 and .Dv NULL is stored in the .Fa limitsp argument, there are no limits set. .Pp The .Fn cap_limit_set function sets limits for the given capability. The limits are provided as an .Xr nvlist 9 . The exact format of the limits depends on the service that the capability represents. .Fn cap_limit_set frees the limits passed to the call, whether or not the operation succeeds or fails. .Pp The .Fn cap_send_nvlist function sends the given .Xr nvlist 9 over the given capability. This is a low level interface to communicate with casper services. It is expected that most services will provide a higher level API. .Pp The .Fn cap_recv_nvlist function receives the given .Xr nvlist 9 over the given capability. .Pp The .Fn cap_xfer_nvlist function sends the given .Xr nvlist 9 , -destroys it, and receives a new +destroys it, +and receives a new .Xr nvlist 9 in response over the given capability. It does not matter if the function succeeds or fails, the .Xr nvlist 9 given for sending will always be destroyed before the function returns. .Pp The .Fn cap_service_open function opens the casper service named in the call using the casper capability obtained via the .Fn cap_init function. The .Fn cap_service_open function returns a capability that provides access to the opened service. Casper supports the following services in the base system: .Pp .Bl -tag -width "system.random" -compact -offset indent .It system.dns provides libc compatible DNS API .It system.grp provides a .Xr getgrent 3 compatible API .It system.net provides a libc compatible network API .It system.pwd provides a .Xr getpwent 3 compatible API .It system.sysctl provides a .Xr sysctlbyname 3 compatible API .It system.syslog provides a .Xr syslog 3 compatible API .El .Sh RETURN VALUES The .Fn cap_clone , .Fn cap_init , .Fn cap_recv_nvlist , .Fn cap_service_open , .Fn cap_wrap and .Fn cap_xfer_nvlist functions return .Dv NULL and set the .Va errno variable on failure. .Pp The .Fn cap_limit_get , .Fn cap_limit_set and .Fn cap_send_nvlist functions return .Dv -1 and set the .Va errno variable on failure. .Pp The .Fn cap_close , .Fn cap_sock and .Fn cap_unwrap functions always succeed. .Sh SEE ALSO .Xr errno 2 , .Xr execve 2 , .Xr kevent 2 , .Xr poll 2 , .Xr select 2 , .Xr cap_dns 3 , .Xr cap_grp 3 , .Xr cap_net 3 , .Xr cap_pwd 3 , .Xr cap_sysctl 3 , .Xr cap_syslog 3 , .Xr libcasper_service 3 , .Xr capsicum 4 , .Xr unix 4 , .Xr nv 9 .Sh HISTORY The .Nm libcasper library first appeared in .Fx 10.3 . .Sh AUTHORS The .Nm libcasper library was implemented by .An Pawel Jakub Dawidek Aq Mt pawel@dawidek.net under sponsorship from the FreeBSD Foundation. The .Nm libcasper new architecture was implemented by .An Mariusz Zaborski Aq Mt oshogbo@FreeBSD.org . diff --git a/lib/libcasper/libcasper/libcasper_service.3 b/lib/libcasper/libcasper/libcasper_service.3 index c210cdde182a..9e0f76cf98d0 100644 --- a/lib/libcasper/libcasper/libcasper_service.3 +++ b/lib/libcasper/libcasper/libcasper_service.3 @@ -1,120 +1,120 @@ .\" Copyright (c) 2018 Mariusz Zaborski .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" $FreeBSD$ .\" -.Dd May 5, 2020 +.Dd November 15, 2021 .Dt LIBCASPER 3 .Os .Sh NAME .Nm CREATE_SERVICE .Nd "casper service declaration macro" .Sh LIBRARY .Lb libcasper .Sh SYNOPSIS .In sys/nv.h .In libcasper.h .In libcasper_service.h .Bd -literal typedef int service_limit_func_t(const nvlist_t *, const nvlist_t *); typedef int service_command_func_t(const char *, const nvlist_t *, nvlist_t *, nvlist_t *); .Ed .Fn CREATE_SERVICE "name" "limit_func" "command_func" "flags" .Sh DESCRIPTION The .Nm CREATE_SERVICE -macro is used to create a new Casper service. +macro is used to create a new casper service. The .Fa name is a string containing the service name, which will be used in the .Xr cap_service_open 3 , function to identify it. .Pp The .Fa limit_func is a function of type .Li service_limit_func_t where the first argument of the function contains an containing .Xr nvlist 9 , old service limits and the second argument contains the new limits. -If the service wasn't limited then the old limits will be set to +If the service was not limited then the old limits will be set to .Dv NULL . This function must not allow the extension of service limits. The .Fa command_func is a function of type .Li service_command_func_t where the first argument is the name of the command that should be executed. The first .Xr nvlist 9 contains the current limits and the second contains an .Xr nvlist 9 with the current request. The last argument contains a return value .Xr nvlist 9 -which contains the response from Casper. +which contains the response from casper. .Pp The .Fa flags argument defines the limits of the service. The supported flags are: .Bl -ohang -offset indent .It CASPER_SERVICE_STDIO -The Casper service has access to the stdio descriptors from the process it was +The casper service has access to the stdio descriptors from the process it was spawned from. .It CASPER_SERVICE_FD -The Casper service has access to all of the descriptors, +The casper service has access to all of the descriptors, besides the stdio descriptors, from the process it was spawned from. .It CASPER_SERVICE_NO_UNIQ_LIMITS -The whole Casper communication is using an +The whole casper communication is using an .Xr nvlist 9 with the .Xr NVLIST_NO_UNIQ 9 flag. .El .Sh SEE ALSO .Xr cap_enter 2 , .Xr libcasper 3 , .Xr capsicum 4 , .Xr nv 9 .Sh HISTORY The .Nm libcasper library first appeared in .Fx 10.3 . .Sh AUTHORS The .Nm libcasper library was implemented by .An Pawel Jakub Dawidek Aq Mt pawel@dawidek.net under sponsorship from the FreeBSD Foundation. The .Nm libcasper new architecture was implemented by .An Mariusz Zaborski Aq Mt oshogbo@FreeBSD.org . diff --git a/lib/libcasper/services/cap_net/cap_net.3 b/lib/libcasper/services/cap_net/cap_net.3 index 765abbdf41aa..e64038a48330 100644 --- a/lib/libcasper/services/cap_net/cap_net.3 +++ b/lib/libcasper/services/cap_net/cap_net.3 @@ -1,288 +1,288 @@ .\" Copyright (c) 2020 Mariusz Zaborski .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" $FreeBSD$ .\" -.Dd August 15, 2020 +.Dd November 15, 2021 .Dt CAP_NET 3 .Os .Sh NAME .Nm cap_bind , .Nm cap_connect , .Nm cap_getaddrinfo , .Nm cap_gethostbyaddr , .Nm cap_gethostbyname , .Nm cap_gethostbyname2 , .Nm cap_getnameinfo , .Nm cap_net_free , .Nm cap_net_limit , .Nm cap_net_limit_addr2name , .Nm cap_net_limit_addr2name_family , .Nm cap_net_limit_bind , .Nm cap_net_limit_connect , .Nm cap_net_limit_init , .Nm cap_net_limit_name2addr , .Nm cap_net_limit_name2addr_family , .Nd "library for networking in capability mode" .Sh LIBRARY .Lb libcap_net .Sh SYNOPSIS .In sys/nv.h .In libcasper.h .In casper/cap_net.h .Ft int .Fn cap_bind "cap_channel_t *chan" "int s" "const struct sockaddr *addr" "socklen_t addrlen" .Ft int .Fn cap_connect "cap_channel_t *chan" "int s" "const struct sockaddr *name" "socklen_t namelen" .Ft int .Fn cap_getaddrinfo "cap_channel_t *chan" "const char *hostname" "const char *servname" "const struct addrinfo *hints" "struct addrinfo **res" .Ft int .Fn cap_getnameinfo "cap_channel_t *chan" "const struct sockaddr *sa" "socklen_t salen" "char *host" "size_t hostlen" "char *serv" "size_t servlen" "int flags" .Ft "struct hostent *" .Fn cap_gethostbyname "const cap_channel_t *chan" "const char *name" .Ft "struct hostent *" .Fn cap_gethostbyname2 "const cap_channel_t *chan" "const char *name" "int af" .Ft "struct hostent *" .Fn cap_gethostbyaddr "const cap_channel_t *chan" "const void *addr" "socklen_t len" "int af" .Ft "cap_net_limit_t *" .Fn cap_net_limit_init "cap_channel_t *chan" "uint64_t mode" .Ft int .Fn cap_net_limit "cap_net_limit_t *limit" .Ft void .Fn cap_net_free "cap_net_limit_t *limit" .Ft "cap_net_limit_t *" .Fn cap_net_limit_addr2name_family "cap_net_limit_t *limit" "int *family" "size_t size" .Ft "cap_net_limit_t *" .Fn cap_net_limit_addr2name "cap_net_limit_t *limit" "const struct sockaddr *sa" "socklen_t salen" .Ft "cap_net_limit_t *" .Fn cap_net_limit_name2addr_family "cap_net_limit_t *limit" "int *family" "size_t size" .Ft "cap_net_limit_t *" .Fn cap_net_limit_name2addr "cap_net_limit_t *limit" "const char *name" "const char *serv" .Ft "cap_net_limit_t *" .Fn cap_net_limit_connect "cap_net_limit_t *limit" "const struct sockaddr *sa" "socklen_t salen" .Ft "cap_net_limit_t *" .Fn cap_net_limit_bind "cap_net_limit_t *limit" "const struct sockaddr *sa" "socklen_t salen" .Sh DESCRIPTION The functions .Fn cap_bind , .Fn cap_connect , .Fn cap_gethostbyname , .Fn cap_gethostbyname2 , .Fn cap_gethostbyaddr and .Fn cap_getnameinfo provide a set of APIs equivalent to .Xr bind 2 , .Xr connect 2 , .Xr gethostbyname 3 , .Xr gethostbyname2 3 , .Xr gethostbyaddr 3 and .Xr getnameinfo 3 except that a connection to the .Nm system.net service needs to be provided. .Sh LIMITS By default, the cap_net capability provides unrestricted access to the network namespace. Applications typically only require access to a small portion of the network namespace: The .Fn cap_net_limit function can be used to restrict access to the network. The .Fn cap_net_limit_init returns an opaque limit handle used to store a list of capabilities. The .Fv mode restricts the functionality of the service. Modes are encoded using the following flags: .Pp .Bd -literal -offset indent -compact CAPNET_ADDR2NAME reverse DNS lookups are allowed with cap_getnameinfo CAPNET_NAME2ADDR name resolution is allowed with cap_getaddrinfo CAPNET_DEPRECATED_ADDR2NAME reverse DNS lookups are allowed with cap_gethostbyaddr CAPNET_DEPRECATED_NAME2ADDR name resolution is allowed with cap_gethostbyname and cap_gethostbyname2 CAPNET_BIND bind syscall is allowed CAPNET_CONNECT connect syscall is allowed CAPNET_CONNECTDNS connect syscall is allowed to the values returned from privies call to the cap_getaddrinfo or cap_gethostbyname .Ed .Pp .Fn cap_net_limit_addr2name_family limits the .Fn cap_getnameinfo and .Fn cap_gethostbyaddr to do reverse DNS lookups to specific family (AF_INET, AF_INET6, etc.) .Pp .Fn cap_net_limit_addr2name limits the .Fn cap_getnameinfo and .Fn cap_gethostbyaddr to do reverse DNS lookups only on those specific structures. .Pp .Fn cap_net_limit_name2addr_family limits the .Fn cap_getaddrinfo , .Fn cap_gethostbyname and .Fn cap_gethostbyname2 to do the name resolution on specific family (AF_INET, AF_INET6, etc.) .Pp .Fn cap_net_limit_addr2name restricts .Fn cap_getaddrinfo , .Fn cap_gethostbyname and .Fn cap_gethostbyname2 to a set of domains. .Pp .Fn cap_net_limit_bind limits .Fn cap_bind to bind only on those specific structures. .Pp .Fn cap_net_limit_connect limits .Fn cap_connect to connect only on those specific structures. If the CAPNET_CONNECTDNS is set the limits are extended to the values returned by .Fn cap_getaddrinfo , .Fn cap_gethostbyname and .Fn cap_gethostbyname2 In case of the .Fn cap_getaddrinfo the restriction is strict. In case of the .Fn cap_gethostbyname and .Fn cap_gethostbyname2 any port will be accepted in the .Fn cap_connect function. .Pp .Fn cap_net_limit applies a set of sysctl limits to the capability, denying access to sysctl variables not belonging to the set. .Pp Once a set of limits is applied, subsequent calls to .Fn cap_net_limit will fail unless the new set is a subset of the current set. .Pp The .Fn cap_net_limit will consume the limits. If the .Fn cap_net_limit was not called the rights may be freed using .Fn cap_net_free . Multiple calls to .Fn cap_net_limit_addr2name_family , .Fn cap_net_limit_addr2name , .Fn cap_net_limit_name2addr_family , .Fn cap_net_limit_name2addr , .Fn cap_net_limit_connect , and .Fn cap_net_limit_bind is supported, each call is extending preview capabilities. .Sh EXAMPLES The following example first opens a capability to casper and then uses this capability to create the .Nm system.net casper service and uses it to resolve a host and connect to it. .Bd -literal cap_channel_t *capcas, *capnet; cap_net_limit_t *limit; int familylimit, error, s; const char *host = "example.com"; struct addrinfo hints, *res; /* Open capability to Casper. */ capcas = cap_init(); if (capcas == NULL) err(1, "Unable to contact Casper"); /* Cache NLA for gai_strerror. */ caph_cache_catpages(); /* Enter capability mode sandbox. */ if (caph_enter_casper() < 0) err(1, "Unable to enter capability mode"); /* Use Casper capability to create capability to the system.net service. */ capnet = cap_service_open(capcas, "system.net"); if (capnet == NULL) err(1, "Unable to open system.net service"); /* Close Casper capability. */ cap_close(capcas); /* Limit system.net to reserve IPv4 addresses, to host example.com . */ limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR | CAPNET_CONNECTDNS); if (limit == NULL) err(1, "Unable to create limits."); cap_net_limit_name2addr(limit, host, "80"); familylimit = AF_INET; cap_net_limit_name2addr_family(limit, &familylimit, 1); if (cap_net_limit(limit) < 0) err(1, "Unable to apply limits."); /* Find IP addresses for the given host. */ memset(&hints, 0, sizeof(hints)); hints.ai_family = AF_INET; hints.ai_socktype = SOCK_STREAM; error = cap_getaddrinfo(capnet, host, "80", &hints, &res); if (error != 0) errx(1, "cap_getaddrinfo(): %s: %s", host, gai_strerror(error)); s = socket(res->ai_family, res->ai_socktype, res->ai_protocol); if (s < 0) err(1, "Unable to create socket"); if (cap_connect(capnet, s, res->ai_addr, res->ai_addrlen) < 0) err(1, "Unable to connect to host"); .Ed .Sh SEE ALSO .Xr bind 2 , .Xr cap_enter 2 , .Xr connect 2 , .Xr caph_enter 3 , .Xr err 3 , .Xr gethostbyaddr 3 , .Xr gethostbyname 3 , .Xr gethostbyname2 3 , .Xr getnameinfo 3 , .Xr capsicum 4 , .Xr nv 9 .Sh AUTHORS .An Mariusz Zaborski Aq Mt oshogbo@FreeBSD.org