331434 |
23-Mar-2018 |
ian |
MFC r306657, r306673, r306726, r307737, r309366, r310135, r323990, r324414
r306657: libcapsicum: introduce Capsicum helpers
Capsicum helpers are a set of inline functions which goal is to reduce duplicated patterns used to Capsicumize applications.
Reviewed by: cem, AllanJude, bapt, ed, emaste Differential Revision: https://reviews.freebsd.org/D8013
r306673: libcapsicum: limit stderr
Don't limit stdout twice, instead limit stderr.
Pointed out by: rpokala@
r306726: Add man pages for Capsicum helpers.
Reviewed by: cem Differential Revision: https://reviews.freebsd.org/D8154
r307737: Fix few sentence in the man page.
Pointed out by: wblock
r309366: capsicum_helpers: Squash errors from closed fds
Squash EBADF from closed stdin, stdout, or stderr in caph_limit_stdio(). Any program used during special shell scripts may commonly be forked from a parent process with closed standard stream. Do the common sense thing for this common use.
Reported by: Iblis Lin <iblis AT hs.ntnu.edu.tw> Reviewed by: oshogbo@ (earlier version) Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D8657
r310135: capsicum_helpers: Add LOOKUP flag
Add a helper routine for opening a directory that is restricted to being used for opening relative files as stdio streams.
I think this will really help basic adaptation of multi-file programs to Capsicum. Rather than having each program initialize a rights object and ioctl/fcntl arrays for their root fd for relative opens, consolidate in the logical place.
Reviewed by: oshogbo@ Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D8743
r323990: capsicum_helpers: Add SEEK to default stdio rights set
PR: 219173 Sponsored by: Dell EMC Isilon
r324414: capsicum_helpers: Add EVENT to default stdio rights set
Without it, calling caph_limit_stdio(3) breaks Irssi.
Reviewed by: oshogbo Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D12622 |
306657 |
03-Oct-2016 |
oshogbo |
libcapsicum: introduce Capsicum helpers
Capsicum helpers are a set of inline functions which goal is to reduce duplicated patterns used to Capsicumize applications.
Reviewed by: cem, AllanJude, bapt, ed, emaste Differential Revision: https://reviews.freebsd.org/D8013
|