capsicum_helpers.h revision 306657 
1/*-
2 * Copyright (c) 2016 Mariusz Zaborski <oshogbo@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 * $FreeBSD: head/lib/libcapsicum/capsicum_helpers.h 306657 2016-10-03 20:48:18Z oshogbo $
27 */
28
29#ifndef _CAPSICUM_HELPERS_H_
30#define	_CAPSICUM_HELPERS_H_
31
32#include <sys/param.h>
33#include <sys/capsicum.h>
34
35#include <errno.h>
36#include <nl_types.h>
37#include <termios.h>
38#include <time.h>
39#include <unistd.h>
40
41#define	CAPH_IGNORE_EBADF	0x0001
42#define	CAPH_READ		0x0002
43#define	CAPH_WRITE		0x0004
44
45static __inline int
46caph_limit_stream(int fd, int flags)
47{
48	cap_rights_t rights;
49	unsigned long cmds[] = { TIOCGETA, TIOCGWINSZ };
50
51	cap_rights_init(&rights, CAP_FCNTL, CAP_FSTAT, CAP_IOCTL);
52
53	if ((flags & CAPH_READ) != 0)
54		cap_rights_set(&rights, CAP_READ);
55	if ((flags & CAPH_WRITE) != 0)
56		cap_rights_set(&rights, CAP_WRITE);
57
58	if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) {
59		if (errno == EBADF && (flags & CAPH_IGNORE_EBADF) != 0)
60			return (0);
61		return (-1);
62	}
63
64	if (cap_ioctls_limit(fd, cmds, nitems(cmds)) < 0 && errno != ENOSYS)
65		return (-1);
66
67	if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS)
68		return (-1);
69
70	return (0);
71}
72
73static __inline int
74caph_limit_stdin(void)
75{
76
77	return (caph_limit_stream(STDIN_FILENO, CAPH_READ));
78}
79
80static __inline int
81caph_limit_stderr(void)
82{
83
84	return (caph_limit_stream(STDERR_FILENO, CAPH_WRITE));
85}
86
87static __inline int
88caph_limit_stdout(void)
89{
90
91	return (caph_limit_stream(STDOUT_FILENO, CAPH_WRITE));
92}
93
94static __inline int
95caph_limit_stdio(void)
96{
97
98	if (caph_limit_stdin() == -1 || caph_limit_stdout() == -1 ||
99	    caph_limit_stdout() == -1) {
100		return (-1);
101	}
102
103	return (0);
104}
105
106static __inline void
107caph_cache_tzdata(void)
108{
109
110	tzset();
111}
112
113static __inline void
114caph_cache_catpages(void)
115{
116
117	(void)catopen("libc", NL_CAT_LOCALE);
118}
119
120#endif /* _CAPSICUM_HELPERS_H_ */
121