diff options
author | Pawel Jakub Dawidek <pjd@FreeBSD.org> | 2013-03-02 21:11:30 +0000 |
---|---|---|
committer | Pawel Jakub Dawidek <pjd@FreeBSD.org> | 2013-03-02 21:11:30 +0000 |
commit | 7493f24ee6846df33931904c87493b08400df5bd (patch) | |
tree | 5dbc48bdb7b78718e22183ef377b76f2e3bc74c2 /usr.bin | |
parent | 136b1ada11e4b3ec91b4b15562ba803e5ab66c10 (diff) | |
download | src-7493f24ee6846df33931904c87493b08400df5bd.tar.gz src-7493f24ee6846df33931904c87493b08400df5bd.zip |
- Implement two new system calls:
int bindat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen);
int connectat(int fd, int s, const struct sockaddr *name, socklen_t namelen);
which allow to bind and connect respectively to a UNIX domain socket with a
path relative to the directory associated with the given file descriptor 'fd'.
- Add manual pages for the new syscalls.
- Make the new syscalls available for processes in capability mode sandbox.
- Add capability rights CAP_BINDAT and CAP_CONNECTAT that has to be present on
the directory descriptor for the syscalls to work.
- Update audit(4) to support those two new syscalls and to handle path
in sockaddr_un structure relative to the given directory descriptor.
- Update procstat(1) to recognize the new capability rights.
- Document the new capability rights in cap_rights_limit(2).
Sponsored by: The FreeBSD Foundation
Discussed with: rwatson, jilles, kib, des
Notes
Notes:
svn path=/head/; revision=247667
Diffstat (limited to 'usr.bin')
-rw-r--r-- | usr.bin/procstat/procstat_files.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/usr.bin/procstat/procstat_files.c b/usr.bin/procstat/procstat_files.c index 030bba138f46..a3137db0852a 100644 --- a/usr.bin/procstat/procstat_files.c +++ b/usr.bin/procstat/procstat_files.c @@ -215,6 +215,13 @@ static struct cap_desc { { CAP_PDWAIT, "pw" }, { CAP_PDKILL, "pk" }, + /* + * Rights that allow to use bindat(2) and connectat(2) syscalls on a + * directory descriptor. + */ + { CAP_BINDAT, "ba" }, + { CAP_CONNECTAT, "ca" }, + /* Aliases and defines that combine multiple rights. */ { CAP_PREAD, "prd" }, { CAP_PWRITE, "pwr" }, |