diff --git a/bin/cat/Makefile b/bin/cat/Makefile
index cba55d2870bb..abfdcbcfbb2e 100644
--- a/bin/cat/Makefile
+++ b/bin/cat/Makefile
@@ -1,18 +1,25 @@
 #	@(#)Makefile	8.1 (Berkeley) 5/31/93
 # $FreeBSD$
 
 .include <src.opts.mk>
 
 PACKAGE=runtime
 PROG=	cat
 
 .ifdef BOOTSTRAPPING
 # For the bootstrap cat we disable all wide char support to allow building
 # on Linux/macOS
 CFLAGS+=-DBOOTSTRAP_CAT
 .endif
 
 HAS_TESTS=
 SUBDIR.${MK_TESTS}+= tests
 
+.if ${MK_CASPER} != "no" && !defined(RESCUE) && !defined(BOOTSTRAPPING)
+LIBADD+=        casper
+LIBADD+=        cap_fileargs
+LIBADD+=        cap_net
+CFLAGS+=-DWITH_CASPER
+.endif
+
 .include <bsd.prog.mk>
diff --git a/bin/cat/cat.c b/bin/cat/cat.c
index 40d91b243bd4..58f7c15cc9cb 100644
--- a/bin/cat/cat.c
+++ b/bin/cat/cat.c
@@ -1,420 +1,501 @@
 /*-
  * SPDX-License-Identifier: BSD-3-Clause
  *
  * Copyright (c) 1989, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
  * This code is derived from software contributed to Berkeley by
  * Kevin Fall.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 
 #if 0
 #ifndef lint
 static char const copyright[] =
 "@(#) Copyright (c) 1989, 1993\n\
 	The Regents of the University of California.  All rights reserved.\n";
 #endif /* not lint */
 #endif
 
 #ifndef lint
 #if 0
 static char sccsid[] = "@(#)cat.c	8.2 (Berkeley) 4/27/95";
 #endif
 #endif /* not lint */
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include <sys/capsicum.h>
 #include <sys/param.h>
 #include <sys/stat.h>
 #ifndef NO_UDOM_SUPPORT
 #include <sys/socket.h>
 #include <sys/un.h>
 #include <netdb.h>
 #endif
 
+#include <capsicum_helpers.h>
 #include <ctype.h>
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <locale.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 #include <wchar.h>
 #include <wctype.h>
 
+#include <libcasper.h>
+#include <casper/cap_fileargs.h>
+#include <casper/cap_net.h>
+
 static int bflag, eflag, lflag, nflag, sflag, tflag, vflag;
 static int rval;
 static const char *filename;
+static fileargs_t *fa;
 
 static void usage(void) __dead2;
 static void scanfiles(char *argv[], int cooked);
 #ifndef BOOTSTRAP_CAT
 static void cook_cat(FILE *);
 #endif
 static void raw_cat(int);
 
 #ifndef NO_UDOM_SUPPORT
+static cap_channel_t *capnet;
+
 static int udom_open(const char *path, int flags);
 #endif
 
 /*
  * Memory strategy threshold, in pages: if physmem is larger than this,
  * use a large buffer.
  */
 #define	PHYSPAGES_THRESHOLD (32 * 1024)
 
 /* Maximum buffer size in bytes - do not allow it to grow larger than this. */
 #define	BUFSIZE_MAX (2 * 1024 * 1024)
 
 /*
  * Small (default) buffer size in bytes. It's inefficient for this to be
  * smaller than MAXPHYS.
  */
 #define	BUFSIZE_SMALL (MAXPHYS)
 
 
 /*
  * For the bootstrapped cat binary (needed for locked appending to METALOG), we
  * disable all flags except -l and -u to avoid non-portable function calls.
  * In the future we may instead want to write a small portable bootstrap tool
  * that locks the output file before writing to it. However, for now
  * bootstrapping cat without multibyte support is the simpler solution.
  */
 #ifdef BOOTSTRAP_CAT
 #define SUPPORTED_FLAGS "lu"
 #else
 #define SUPPORTED_FLAGS "belnstuv"
 #endif
 
+#ifndef NO_UDOM_SUPPORT
+static void
+init_casper_net(cap_channel_t *casper)
+{
+	cap_net_limit_t *limit;
+	int familylimit;
+
+	capnet = cap_service_open(casper, "system.net");
+	if (capnet == NULL)
+		err(EXIT_FAILURE, "unable to create network service");
+
+	limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR |
+	    CAPNET_CONNECTDNS);
+	if (limit == NULL)
+		err(EXIT_FAILURE, "unable to create limits");
+
+	familylimit = AF_LOCAL;
+	cap_net_limit_name2addr_family(limit, &familylimit, 1);
+
+	if (cap_net_limit(limit) < 0)
+		err(EXIT_FAILURE, "unable to apply limits");
+}
+#endif
+
+static void
+init_casper(int argc, char *argv[])
+{
+	cap_channel_t *casper;
+	cap_rights_t rights;
+
+	casper = cap_init();
+	if (casper == NULL)
+		err(EXIT_FAILURE, "unable to create Casper");
+
+	fa = fileargs_cinit(casper, argc, argv, O_RDONLY, 0,
+	    cap_rights_init(&rights, CAP_READ | CAP_FSTAT | CAP_FCNTL),
+	    FA_OPEN | FA_REALPATH);
+	if (fa == NULL)
+		err(EXIT_FAILURE, "unable to create fileargs");
+
+#ifndef NO_UDOM_SUPPORT
+	init_casper_net(casper);
+#endif
+
+	cap_close(casper);
+}
+
 int
 main(int argc, char *argv[])
 {
 	int ch;
 	struct flock stdout_lock;
 
 	setlocale(LC_CTYPE, "");
 
 	while ((ch = getopt(argc, argv, SUPPORTED_FLAGS)) != -1)
 		switch (ch) {
 		case 'b':
 			bflag = nflag = 1;	/* -b implies -n */
 			break;
 		case 'e':
 			eflag = vflag = 1;	/* -e implies -v */
 			break;
 		case 'l':
 			lflag = 1;
 			break;
 		case 'n':
 			nflag = 1;
 			break;
 		case 's':
 			sflag = 1;
 			break;
 		case 't':
 			tflag = vflag = 1;	/* -t implies -v */
 			break;
 		case 'u':
 			setbuf(stdout, NULL);
 			break;
 		case 'v':
 			vflag = 1;
 			break;
 		default:
 			usage();
 		}
 	argv += optind;
+	argc -= optind;
 
 	if (lflag) {
 		stdout_lock.l_len = 0;
 		stdout_lock.l_start = 0;
 		stdout_lock.l_type = F_WRLCK;
 		stdout_lock.l_whence = SEEK_SET;
 		if (fcntl(STDOUT_FILENO, F_SETLKW, &stdout_lock) == -1)
 			err(EXIT_FAILURE, "stdout");
 	}
 
+	init_casper(argc, argv);
+
+	caph_cache_catpages();
+
+	if (caph_enter_casper() < 0)
+		err(EXIT_FAILURE, "capsicum");
+
 	if (bflag || eflag || nflag || sflag || tflag || vflag)
 		scanfiles(argv, 1);
 	else
 		scanfiles(argv, 0);
 	if (fclose(stdout))
 		err(1, "stdout");
 	exit(rval);
 	/* NOTREACHED */
 }
 
 static void
 usage(void)
 {
 
 	fprintf(stderr, "usage: cat [-" SUPPORTED_FLAGS "] [file ...]\n");
 	exit(1);
 	/* NOTREACHED */
 }
 
 static void
 scanfiles(char *argv[], int cooked __unused)
 {
 	int fd, i;
 	char *path;
 #ifndef BOOTSTRAP_CAT
 	FILE *fp;
 #endif
 
 	i = 0;
 	fd = -1;
 	while ((path = argv[i]) != NULL || i == 0) {
 		if (path == NULL || strcmp(path, "-") == 0) {
 			filename = "stdin";
 			fd = STDIN_FILENO;
 		} else {
 			filename = path;
-			fd = open(path, O_RDONLY);
+			fd = fileargs_open(fa, path);
 #ifndef NO_UDOM_SUPPORT
 			if (fd < 0 && errno == EOPNOTSUPP)
 				fd = udom_open(path, O_RDONLY);
 #endif
 		}
 		if (fd < 0) {
 			warn("%s", path);
 			rval = 1;
 #ifndef BOOTSTRAP_CAT
 		} else if (cooked) {
 			if (fd == STDIN_FILENO)
 				cook_cat(stdin);
 			else {
 				fp = fdopen(fd, "r");
 				cook_cat(fp);
 				fclose(fp);
 			}
 #endif
 		} else {
 			raw_cat(fd);
 			if (fd != STDIN_FILENO)
 				close(fd);
 		}
 		if (path == NULL)
 			break;
 		++i;
 	}
 }
 
 #ifndef BOOTSTRAP_CAT
 static void
 cook_cat(FILE *fp)
 {
 	int ch, gobble, line, prev;
 	wint_t wch;
 
 	/* Reset EOF condition on stdin. */
 	if (fp == stdin && feof(stdin))
 		clearerr(stdin);
 
 	line = gobble = 0;
 	for (prev = '\n'; (ch = getc(fp)) != EOF; prev = ch) {
 		if (prev == '\n') {
 			if (sflag) {
 				if (ch == '\n') {
 					if (gobble)
 						continue;
 					gobble = 1;
 				} else
 					gobble = 0;
 			}
 			if (nflag) {
 				if (!bflag || ch != '\n') {
 					(void)fprintf(stdout, "%6d\t", ++line);
 					if (ferror(stdout))
 						break;
 				} else if (eflag) {
 					(void)fprintf(stdout, "%6s\t", "");
 					if (ferror(stdout))
 						break;
 				}
 			}
 		}
 		if (ch == '\n') {
 			if (eflag && putchar('$') == EOF)
 				break;
 		} else if (ch == '\t') {
 			if (tflag) {
 				if (putchar('^') == EOF || putchar('I') == EOF)
 					break;
 				continue;
 			}
 		} else if (vflag) {
 			(void)ungetc(ch, fp);
 			/*
 			 * Our getwc(3) doesn't change file position
 			 * on error.
 			 */
 			if ((wch = getwc(fp)) == WEOF) {
 				if (ferror(fp) && errno == EILSEQ) {
 					clearerr(fp);
 					/* Resync attempt. */
 					memset(&fp->_mbstate, 0, sizeof(mbstate_t));
 					if ((ch = getc(fp)) == EOF)
 						break;
 					wch = ch;
 					goto ilseq;
 				} else
 					break;
 			}
 			if (!iswascii(wch) && !iswprint(wch)) {
 ilseq:
 				if (putchar('M') == EOF || putchar('-') == EOF)
 					break;
 				wch = toascii(wch);
 			}
 			if (iswcntrl(wch)) {
 				ch = toascii(wch);
 				ch = (ch == '\177') ? '?' : (ch | 0100);
 				if (putchar('^') == EOF || putchar(ch) == EOF)
 					break;
 				continue;
 			}
 			if (putwchar(wch) == WEOF)
 				break;
 			ch = -1;
 			continue;
 		}
 		if (putchar(ch) == EOF)
 			break;
 	}
 	if (ferror(fp)) {
 		warn("%s", filename);
 		rval = 1;
 		clearerr(fp);
 	}
 	if (ferror(stdout))
 		err(1, "stdout");
 }
 #endif /* BOOTSTRAP_CAT */
 
 static void
 raw_cat(int rfd)
 {
 	long pagesize;
 	int off, wfd;
 	ssize_t nr, nw;
 	static size_t bsize;
 	static char *buf = NULL;
 	struct stat sbuf;
 
 	wfd = fileno(stdout);
 	if (buf == NULL) {
 		if (fstat(wfd, &sbuf))
 			err(1, "stdout");
 		if (S_ISREG(sbuf.st_mode)) {
 			/* If there's plenty of RAM, use a large copy buffer */
 			if (sysconf(_SC_PHYS_PAGES) > PHYSPAGES_THRESHOLD)
 				bsize = MIN(BUFSIZE_MAX, MAXPHYS * 8);
 			else
 				bsize = BUFSIZE_SMALL;
 		} else {
 			bsize = sbuf.st_blksize;
 			pagesize = sysconf(_SC_PAGESIZE);
 			if (pagesize > 0)
 				bsize = MAX(bsize, (size_t)pagesize);
 		}
 		if ((buf = malloc(bsize)) == NULL)
 			err(1, "malloc() failure of IO buffer");
 	}
 	while ((nr = read(rfd, buf, bsize)) > 0)
 		for (off = 0; nr; nr -= nw, off += nw)
 			if ((nw = write(wfd, buf + off, (size_t)nr)) < 0)
 				err(1, "stdout");
 	if (nr < 0) {
 		warn("%s", filename);
 		rval = 1;
 	}
 }
 
 #ifndef NO_UDOM_SUPPORT
 
 static int
 udom_open(const char *path, int flags)
 {
 	struct addrinfo hints, *res, *res0;
 	char rpath[PATH_MAX];
 	int fd = -1;
 	int error;
+	cap_rights_t rights;
 
 	/*
 	 * Construct the unix domain socket address and attempt to connect.
 	 */
 	bzero(&hints, sizeof(hints));
 	hints.ai_family = AF_LOCAL;
-	if (realpath(path, rpath) == NULL)
+
+	if (fileargs_realpath(fa, path, rpath) == NULL)
 		return (-1);
-	error = getaddrinfo(rpath, NULL, &hints, &res0);
+
+	error = cap_getaddrinfo(capnet, rpath, NULL, &hints, &res0);
 	if (error) {
 		warn("%s", gai_strerror(error));
 		errno = EINVAL;
 		return (-1);
 	}
+	cap_rights_init(&rights, CAP_CONNECT, CAP_READ, CAP_WRITE,
+	    CAP_SHUTDOWN, CAP_FSTAT, CAP_FCNTL);
 	for (res = res0; res != NULL; res = res->ai_next) {
 		fd = socket(res->ai_family, res->ai_socktype,
 		    res->ai_protocol);
 		if (fd < 0) {
 			freeaddrinfo(res0);
 			return (-1);
 		}
-		error = connect(fd, res->ai_addr, res->ai_addrlen);
+		if (caph_rights_limit(fd, &rights) < 0) {
+			close(fd);
+			return (-1);
+		}
+		error = cap_connect(capnet, fd, res->ai_addr, res->ai_addrlen);
 		if (error == 0)
 			break;
 		else {
 			close(fd);
 			fd = -1;
 		}
 	}
 	freeaddrinfo(res0);
 
 	/*
 	 * handle the open flags by shutting down appropriate directions
 	 */
 	if (fd >= 0) {
 		switch(flags & O_ACCMODE) {
 		case O_RDONLY:
+			cap_rights_clear(&rights, CAP_WRITE);
 			if (shutdown(fd, SHUT_WR) == -1)
 				warn(NULL);
 			break;
 		case O_WRONLY:
+			cap_rights_clear(&rights, CAP_READ);
 			if (shutdown(fd, SHUT_RD) == -1)
 				warn(NULL);
 			break;
 		default:
 			break;
 		}
+
+		cap_rights_clear(&rights, CAP_CONNECT, CAP_SHUTDOWN);
+		if (caph_rights_limit(fd, &rights) < 0) {
+			close(fd);
+			return (-1);
+		}
 	}
 	return (fd);
 }
 
 #endif
diff --git a/tools/build/Makefile b/tools/build/Makefile
index 28257a2ea2e5..c0c1786d4bfa 100644
--- a/tools/build/Makefile
+++ b/tools/build/Makefile
@@ -1,347 +1,348 @@
 # $FreeBSD$
 
 .PATH: ${.CURDIR}/../../include
 
 LIB=		egacy
 SRC=
 INCSGROUPS=	INCS SYSINCS CASPERINC UFSINCS FFSINCS MSDOSFSINCS DISKINCS
 INCSGROUPS+=	MACHINESYSINCS RPCINCS
 INCS=
 
 SYSINCSDIR=	${INCLUDEDIR}/sys
 CASPERINCDIR=	${INCLUDEDIR}/casper
 # Also add ufs/ffs/msdosfs/disk headers to allow building makefs as a bootstrap tool
 UFSINCSDIR=	${INCLUDEDIR}/ufs/ufs
 FFSINCSDIR=	${INCLUDEDIR}/ufs/ffs
 MSDOSFSINCSDIR=	${INCLUDEDIR}/fs/msdosfs
 DISKINCSDIR=	${INCLUDEDIR}/sys/disk
 MACHINESYSINCSDIR=	${INCLUDEDIR}/machine
 RPCINCSDIR=	${INCLUDEDIR}/rpc
 
 BOOTSTRAPPING?=	0
 
 
 .if ${.MAKE.OS} == "Darwin"
 _XCODE_ROOT!=xcode-select -p
 # since macOS 10.14 C headers are no longer installed in /usr but only
 # provided via the SDK
 .if ${_XCODE_ROOT} == "/Library/Developer/CommandLineTools"
 # Only command line tools installed -> host headers are in the SDKs directory
 _MACOS_SDK_DIR=${_XCODE_ROOT}/SDKs/MacOSX.sdk/
 .else
 # Full XCode installed -> host headers are below Platforms/MacOSX.platform
 _MACOS_SDK_DIR=${_XCODE_ROOT}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk
 .endif
 HOST_INCLUDE_ROOT=${_MACOS_SDK_DIR}/usr/include
 .if !exists(${HOST_INCLUDE_ROOT}/stdio.h)
 .error "You must install the macOS SDK (try xcode-select --install)"
 .endif
 .else
 HOST_INCLUDE_ROOT=/usr/include
 .endif
 
 # Allow building libc-internal files (also on non-FreeBSD hosts)
 CFLAGS+=	-I${.CURDIR}/libc-bootstrap
 # Symbol versioning is not required for -legacy (and macOS bootstrap)
 MK_SYMVER=	no
 
 _WITH_PWCACHEDB!= grep -c pwcache_groupdb ${HOST_INCLUDE_ROOT}/grp.h || true
 .if ${_WITH_PWCACHEDB} == 0
 .PATH: ${.CURDIR}/../../contrib/libc-pwcache
 CFLAGS.pwcache.c+=	-I${.CURDIR}/../../contrib/libc-pwcache
 SRCS+=		pwcache.c
 .endif
 
 _WITH_STRSVIS!=	grep -c strsvis ${HOST_INCLUDE_ROOT}/vis.h 2>/dev/null || true
 .if ${_WITH_STRSVIS} == 0
 .PATH: ${.CURDIR}/../../contrib/libc-vis
 INCS+=		vis.h
 SRCS+=		vis.c unvis.c
 CFLAGS.vis.c+=	-I${.CURDIR}/../../contrib/libc-vis -DHAVE_VIS=0 -DHAVE_SVIS=0
 CFLAGS.unvis.c+=	-I${.CURDIR}/../../contrib/libc-vis -DHAVE_VIS=0 -DHAVE_SVIS=0
 .endif
 
 _WITH_REALLOCARRAY!= grep -c reallocarray ${HOST_INCLUDE_ROOT}/stdlib.h || true
 .if ${_WITH_REALLOCARRAY} == 0
 .PATH: ${.CURDIR}/../../lib/libc/stdlib
 INCS+=		stdlib.h
 SRCS+=		reallocarray.c
 .endif
 
 _WITH_UTIMENS!= grep -c utimensat ${HOST_INCLUDE_ROOT}/sys/stat.h || true
 .if ${_WITH_UTIMENS} == 0
 SYSINCS+=	stat.h
 SRCS+=		futimens.c utimensat.c
 .endif
 
 _WITH_EXPLICIT_BZERO!= grep -c explicit_bzero ${HOST_INCLUDE_ROOT}/strings.h || true
 .if ${_WITH_EXPLICIT_BZERO} == 0
 # .PATH: ${SRCTOP}/sys/libkern
 # Adding sys/libkern to .PATH breaks building the cross-build compat library
 # since that attempts to build strlcpy.c from libc and adding libkern here will
 # cause it to pick the file from libkern instead (which won't compile).
 # Avoid modifying .PATH by creating a copy in the build directory instead.
 explicit_bzero.c: ${SRCTOP}/sys/libkern/explicit_bzero.c
 	cp ${.ALLSRC} ${.TARGET}
 CLEANFILES+=	explicit_bzero.c
 INCS+=		strings.h
 SRCS+=		explicit_bzero.c
 .endif
 
 
 .if exists(${HOST_INCLUDE_ROOT}/capsicum_helpers.h)
 _WITH_CAPH_ENTER!= grep -c caph_enter ${HOST_INCLUDE_ROOT}/capsicum_helpers.h || true
 _WITH_CAPH_RIGHTS_LIMIT!= grep -c caph_rights_limit ${HOST_INCLUDE_ROOT}/capsicum_helpers.h || true
 .endif
 .if !defined(_WITH_CAPH_ENTER) || ${_WITH_CAPH_ENTER} == 0 || ${_WITH_CAPH_RIGHTS_LIMIT} == 0
 .PATH: ${SRCTOP}/lib/libcapsicum
 INCS+=		capsicum_helpers.h
 .PATH: ${SRCTOP}/lib/libcasper/libcasper
 INCS+=		libcasper.h
 .endif
 
 # rpcgen should build against the source tree rpc/types.h and not the host.
 # This is especially important on non-FreeBSD systems where the types may
 # not match.
 RPCINCS+=	${SRCTOP}/sys/rpc/types.h
 
 INCS+=	${SRCTOP}/include/mpool.h
 INCS+=	${SRCTOP}/include/ndbm.h
 INCS+=	${SRCTOP}/include/err.h
 INCS+=	${SRCTOP}/include/stringlist.h
 
 # Needed to build arc4random.c
 INCSGROUPS+=	CHACHA20INCS
 CHACHA20INCSDIR=	${INCLUDEDIR}/crypto/chacha20
 CHACHA20INCS+=	${SRCTOP}/sys/crypto/chacha20/_chacha.h \
 	${SRCTOP}/sys/crypto/chacha20/chacha.h
 
 _host_arch=${MACHINE}
 .if ${_host_arch} == "x86_64"
 # bmake on Linux/mac often prints that instead of amd64
 _host_arch=amd64
 .endif
 .if ${_host_arch} == "unknown"
 # HACK: If MACHINE is unknown, assume we are building on x86
 _host_arch=amd64
 .endif
 MACHINESYSINCS+=	${SRCTOP}/sys/${_host_arch}/include/elf.h
 .if ${_host_arch} == "amd64" || ${_host_arch} == "i386"
 INCSGROUPS+=	X86INCS
 X86INCSDIR=	${INCLUDEDIR}/x86
 X86INCS+=	${SRCTOP}/sys/x86/include/elf.h
 .endif
 
 # needed for btxld:
 MACHINESYSINCS+=	${SRCTOP}/sys/${_host_arch}/include/exec.h
 MACHINESYSINCS+=	${SRCTOP}/sys/${_host_arch}/include/reloc.h
 INCS+=	${SRCTOP}/include/a.out.h
 INCS+=	${SRCTOP}/include/nlist.h
 SYSINCS+=	${SRCTOP}/sys/sys/imgact_aout.h
 SYSINCS+=	${SRCTOP}/sys/sys/nlist_aout.h
 
 
 .if ${.MAKE.OS} != "FreeBSD"
 .PATH: ${.CURDIR}/cross-build
 # dbopen() behaves differently on Linux and FreeBSD so we ensure that we
 # bootstrap the FreeBSD db code. The cross-build headers #define dbopen() to
 # __freebsd_dbopen() so that we don't ever use the host version
 INCS+=	${SRCTOP}/include/db.h
 LIBC_SRCTOP=	${SRCTOP}/lib/libc/
 .include "${LIBC_SRCTOP}/db/Makefile.inc"
 # Do the same as we did for dbopen() for getopt() on since it's not compatible
 # on Linux (and to avoid surprises also compile the FreeBSD code on macOS)
 .PATH: ${LIBC_SRCTOP}/stdlib
 SRCS+=	getopt.c getopt_long.c
 INCS+=	 ${SRCTOP}/include/getopt.h
 
 # getcap.c is needed for cap_mkdb:
 .PATH: ${LIBC_SRCTOP}/gen
 SRCS+=	getcap.c
 # Add various libbc functions that are not available in glibc:
 SRCS+=	stringlist.c setmode.c
 SRCS+=	strtonum.c merge.c heapsort.c reallocf.c
 .PATH: ${LIBC_SRCTOP}/locale
 SRCS+=	rpmatch.c
 
 .if ${.MAKE.OS} == "Linux"
 # On Linux, glibc does not provide strlcpy,strlcat or strmode.
 .PATH: ${LIBC_SRCTOP}/string
 SRCS+=	strlcpy.c strlcat.c strmode.c
 # Compile the fgetln/fgetwln/closefrom fallback code from libbsd:
 SRCS+=	fgetln_fallback.c fgetwln_fallback.c closefrom.c
 CFLAGS.closefrom.c+=	-DSTDC_HEADERS -DHAVE_SYS_DIR_H -DHAVE_DIRENT_H \
 	-DHAVE_DIRFD -DHAVE_SYSCONF
 # Provide warnc/errc/getprogname/setprograme
 SRCS+=	err.c progname.c
 # Stub implementations of fflagstostr/strtofflags
 SRCS+=	fflags.c
 .endif
 # Provide the same arc4random implementation on Linux/macOS
 CFLAGS.arc4random.c+=	-I${SRCTOP}/sys/crypto/chacha20 -D__isthreaded=1
 SRCS+=	arc4random.c arc4random_uniform.c
 
 # expand_number() is not provided by either Linux or MacOS libutil
 .PATH: ${SRCTOP}/lib/libutil
 SRCS+=	expand_number.c
 # Linux libutil also doesn't have fparseln
 SRCS+=	fparseln.c
 # A dummy sysctl for tzsetup:
 SRCS+=	fake_sysctl.c
 
 # capsicum support
 SYSINCS+=	${SRCTOP}/sys/sys/capsicum.h
 SYSINCS+=	${SRCTOP}/sys/sys/caprights.h
 SRCS+=	capsicum_stubs.c
 # XXX: we can't add ${SRCTOP}/sys/kern to .PATH since that will causes
 # conflicts with other files. Instead copy subr_capability to the build dir.
 subr_capability.c: ${SRCTOP}/sys/kern/subr_capability.c
 	cp ${.ALLSRC} ${.TARGET}
 SRCS+=	subr_capability.c
 CLEANFILES+=	subr_capability.c
 .endif
 
 CASPERINC+=	${SRCTOP}/lib/libcasper/services/cap_fileargs/cap_fileargs.h
+CASPERINC+=	${SRCTOP}/lib/libcasper/services/cap_net/cap_net.h
 
 .if empty(SRCS)
 SRCS=		dummy.c
 .endif
 
 .if defined(CROSS_BUILD_TESTING)
 SUBDIR=		cross-build
 .endif
 
 # To allow bootstrapping makefs on FreeBSD 11 or non-FreeBSD systems:
 UFSINCS+=	${SRCTOP}/sys/ufs/ufs/dinode.h
 UFSINCS+=	${SRCTOP}/sys/ufs/ufs/dir.h
 FFSINCS+=	${SRCTOP}/sys/ufs/ffs/fs.h
 
 MSDOSFSINCS+=	${SRCTOP}/sys/fs/msdosfs/bootsect.h
 MSDOSFSINCS+=	${SRCTOP}/sys/fs/msdosfs/bpb.h
 MSDOSFSINCS+=	${SRCTOP}/sys/fs/msdosfs/denode.h
 MSDOSFSINCS+=	${SRCTOP}/sys/fs/msdosfs/direntry.h
 MSDOSFSINCS+=	${SRCTOP}/sys/fs/msdosfs/fat.h
 MSDOSFSINCS+=	${SRCTOP}/sys/fs/msdosfs/msdosfsmount.h
 DISKINCS+=	${SRCTOP}/sys/sys/disk/bsd.h
 
 # Needed to build config (since it uses libnv)
 SYSINCS+=	${SRCTOP}/sys/sys/nv.h ${SRCTOP}/sys/sys/cnv.h \
 		${SRCTOP}/sys/sys/dnv.h
 
 # Needed when bootstrapping ldd (since it uses DF_1_PIE)
 SYSINCS+=	${SRCTOP}/sys/sys/elf32.h
 SYSINCS+=	${SRCTOP}/sys/sys/elf64.h
 SYSINCS+=	${SRCTOP}/sys/sys/elf_common.h
 SYSINCS+=	${SRCTOP}/sys/sys/elf_generic.h
 SYSINCS+=	${SRCTOP}/sys/sys/queue.h
 SYSINCS+=	${SRCTOP}/sys/sys/md5.h
 SYSINCS+=	${SRCTOP}/sys/sys/sbuf.h
 SYSINCS+=	${SRCTOP}/sys/sys/tree.h
 
 # vtfontcvt is using sys/font.h
 SYSINCS+=	${SRCTOP}/sys/sys/font.h
 # For mkscrfil.c:
 SYSINCS+=	${SRCTOP}/sys/sys/consio.h
 # for gencat:
 INCS+=	${SRCTOP}/include/nl_types.h
 # for vtfontcvt:
 SYSINCS+=	${SRCTOP}/sys/sys/fnv_hash.h
 # opensolaris compatibility
 INCS+=	${SRCTOP}/include/elf.h
 SYSINCS+=	${SRCTOP}/sys/sys/elf.h
 
 # We want to run the build with only ${WORLDTMP} in $PATH to ensure we don't
 # accidentally run tools that are incompatible but happen to be in $PATH.
 # This is especially important when building on Linux/MacOS where many of the
 # programs used during the build accept different flags or generate different
 # output. On those platforms we only symlink the tools known to be compatible
 # (e.g. basic utilities such as mkdir) into ${WORLDTMP} and build all others
 # from the FreeBSD sources during the bootstrap-tools stage.
 
 # basic commands: It is fine to use the host version for all of these even on
 # Linux/MacOS since we only use flags that are supported by all of them.
 _host_tools_to_symlink=	basename bzip2 bunzip2 chmod chown cmp comm cp date dd \
 	dirname echo env false find fmt gzip gunzip head hostname id ln ls \
 	mkdir mv nice patch rm sh sleep stat tee touch tr true uname uniq unxz \
 	wc which xz
 
 # We also need a symlink to the absolute path to the make binary used for
 # the toplevel makefile. This is not necessarily the same as `which make`
 # since e.g. on Linux and MacOS that will be GNU make.
 _make_abs!=	which "${MAKE}"
 _host_abs_tools_to_symlink=	${_make_abs}:make ${_make_abs}:bmake
 
 .if ${.MAKE.OS} != "FreeBSD"
 _make_abs!=	which "${MAKE}"
 _host_abs_tools_to_symlink+=	${_make_abs}:make ${_make_abs}:bmake
 .if ${.MAKE.OS} == "Darwin"
 # /usr/bin/cpp may invoke xcrun:
 _host_tools_to_symlink+=xcrun
 .endif  # ${.MAKE.OS} == "Darwin"
 # On Ubuntu /bin/sh is dash which is totally useless. Let's just link bash
 # as the build sh since that will work fine.
 _host_abs_tools_to_symlink+=	/bin/bash:sh
 _host_tools_to_symlink:=${_host_tools_to_symlink:Nsh}
 .endif
 
 host-symlinks:
 	@echo "Linking host tools into ${DESTDIR}/bin"
 .for _tool in ${_host_tools_to_symlink}
 	@export PATH=$${PATH}:/usr/local/bin; source_path=`which ${_tool}`; \
 	if [ ! -e "$${source_path}" ] ; then \
 		echo "Cannot find host tool '${_tool}' in PATH ($$PATH)." >&2; false; \
 	fi; \
 	rm -f "${DESTDIR}/bin/${_tool}"; \
 	cp -pf "$${source_path}" "${DESTDIR}/bin/${_tool}"
 .endfor
 .for _tool in ${_host_abs_tools_to_symlink}
 	@source_path="${_tool:S/:/ /:[1]}"; \
 	target_path="${DESTDIR}/bin/${_tool:S/:/ /:[2]}"; \
 	if [ ! -e "$${source_path}" ] ; then \
 		echo "Host tool '${src_path}' is missing"; false; \
 	fi; \
 	rm -f "$${target_path}"; \
 	cp -pf "$${source_path}" "$${target_path}"
 .endfor
 .if exists(/usr/libexec/flua)
 	rm -f ${DESTDIR}/usr/libexec/flua
 	cp -pf /usr/libexec/flua ${DESTDIR}/usr/libexec/flua
 .endif
 
 # Create all the directories that are needed during the legacy, bootstrap-tools
 # and cross-tools stages. We do this here using mkdir since mtree may not exist
 # yet (this happens if we are crossbuilding from Linux/Mac).
 INSTALLDIR_LIST= \
 	bin \
 	lib/casper \
 	lib/geom \
 	usr/include/casper \
 	usr/include/private/ucl \
 	usr/include/private/zstd \
 	usr/lib \
 	usr/libexec
 
 installdirs:
 	mkdir -p ${INSTALLDIR_LIST:S,^,${DESTDIR}/,}
 
 # Link usr/bin, sbin, and usr/sbin to bin so that it doesn't matter whether a
 # bootstrap tool was added to WORLTMP with a symlink or by building it in the
 # bootstrap-tools phase. We could also overrride BINDIR when building bootstrap
 # tools but adding the symlinks is easier and means all tools are also
 # in the directory that they are installed to normally.
 
 .for _dir in sbin usr/sbin usr/bin
 # delete existing directories from before r340157
 	@if [ -e ${DESTDIR}/${_dir} ] && [ ! -L ${DESTDIR}/${_dir} ]; then \
 	    echo "removing old non-symlink ${DESTDIR}/${_dir}"; \
 	    rm -rf "${DESTDIR}/${_dir}"; \
 	fi
 .endfor
 	ln -sfn bin ${DESTDIR}/sbin
 	ln -sfn ../bin ${DESTDIR}/usr/bin
 	ln -sfn ../bin ${DESTDIR}/usr/sbin
 .for _group in ${INCSGROUPS:NINCS}
 	mkdir -p "${DESTDIR}/${${_group}DIR}"
 .endfor
 
 .include <bsd.lib.mk>