Author: oshogbo Date: Mon Oct 3 20:48:18 2016 New Revision: 306657 URL: https://svnweb.freebsd.org/changeset/base/306657
Log: libcapsicum: introduce Capsicum helpers Capsicum helpers are a set of inline functions which goal is to reduce duplicated patterns used to Capsicumize applications. Reviewed by: cem, AllanJude, bapt, ed, emaste Differential Revision: https://reviews.freebsd.org/D8013 Added: head/lib/libcapsicum/ head/lib/libcapsicum/Makefile (contents, props changed) head/lib/libcapsicum/capsicum_helpers.h (contents, props changed) Modified: head/lib/Makefile Modified: head/lib/Makefile ============================================================================== --- head/lib/Makefile Mon Oct 3 20:05:33 2016 (r306656) +++ head/lib/Makefile Mon Oct 3 20:48:18 2016 (r306657) @@ -38,6 +38,7 @@ SUBDIR= ${SUBDIR_BOOTSTRAP} \ libbz2 \ libcalendar \ libcam \ + libcapsicum \ ${_libcasper} \ ${_libcom_err} \ libcompat \ Added: head/lib/libcapsicum/Makefile ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/lib/libcapsicum/Makefile Mon Oct 3 20:48:18 2016 (r306657) @@ -0,0 +1,7 @@ +# $FreeBSD$ + +PACKAGE=lib${LIB} + +INCS= capsicum_helpers.h + +.include <bsd.lib.mk> Added: head/lib/libcapsicum/capsicum_helpers.h ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/lib/libcapsicum/capsicum_helpers.h Mon Oct 3 20:48:18 2016 (r306657) @@ -0,0 +1,120 @@ +/*- + * Copyright (c) 2016 Mariusz Zaborski <[email protected]> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * $FreeBSD$ + */ + +#ifndef _CAPSICUM_HELPERS_H_ +#define _CAPSICUM_HELPERS_H_ + +#include <sys/param.h> +#include <sys/capsicum.h> + +#include <errno.h> +#include <nl_types.h> +#include <termios.h> +#include <time.h> +#include <unistd.h> + +#define CAPH_IGNORE_EBADF 0x0001 +#define CAPH_READ 0x0002 +#define CAPH_WRITE 0x0004 + +static __inline int +caph_limit_stream(int fd, int flags) +{ + cap_rights_t rights; + unsigned long cmds[] = { TIOCGETA, TIOCGWINSZ }; + + cap_rights_init(&rights, CAP_FCNTL, CAP_FSTAT, CAP_IOCTL); + + if ((flags & CAPH_READ) != 0) + cap_rights_set(&rights, CAP_READ); + if ((flags & CAPH_WRITE) != 0) + cap_rights_set(&rights, CAP_WRITE); + + if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { + if (errno == EBADF && (flags & CAPH_IGNORE_EBADF) != 0) + return (0); + return (-1); + } + + if (cap_ioctls_limit(fd, cmds, nitems(cmds)) < 0 && errno != ENOSYS) + return (-1); + + if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) + return (-1); + + return (0); +} + +static __inline int +caph_limit_stdin(void) +{ + + return (caph_limit_stream(STDIN_FILENO, CAPH_READ)); +} + +static __inline int +caph_limit_stderr(void) +{ + + return (caph_limit_stream(STDERR_FILENO, CAPH_WRITE)); +} + +static __inline int +caph_limit_stdout(void) +{ + + return (caph_limit_stream(STDOUT_FILENO, CAPH_WRITE)); +} + +static __inline int +caph_limit_stdio(void) +{ + + if (caph_limit_stdin() == -1 || caph_limit_stdout() == -1 || + caph_limit_stdout() == -1) { + return (-1); + } + + return (0); +} + +static __inline void +caph_cache_tzdata(void) +{ + + tzset(); +} + +static __inline void +caph_cache_catpages(void) +{ + + (void)catopen("libc", NL_CAT_LOCALE); +} + +#endif /* _CAPSICUM_HELPERS_H_ */ _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "[email protected]"
