Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/kern/capabilities.conf
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 ## 2 ## Copyright (c) 2008-2010 Robert N. M. Watson 3 ## All rights reserved. 4 ## 5 ## This software was developed at the University of Cambridge Computer 6 ## Laboratory with support from a grant from Google, Inc. 7 ## 8 ## Redistribution and use in source and binary forms, with or without 9 ## modification, are permitted provided that the following conditions 10 ## are met: 11 ## 1. Redistributions of source code must retain the above copyright 12 ## notice, this list of conditions and the following disclaimer. 13 ## 2. Redistributions in binary form must reproduce the above copyright 14 ## notice, this list of conditions and the following disclaimer in the 15 ## documentation and/or other materials provided with the distribution. 16 ## 17 ## THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 ## ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 ## IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 ## ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 ## FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 ## DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 ## OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 ## HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 ## LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 ## OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 ## SUCH DAMAGE. 28 ## 29 ## List of system calls enabled in capability mode, one name per line. 30 ## 31 ## Notes: 32 ## - sys_exit(2), abort2(2) and close(2) are very important. 33 ## - Sorted alphabetically, please keep it that way. 34 ## 35 ## $FreeBSD: releng/10.1/sys/kern/capabilities.conf 255374 2013-09-07 19:16:02Z pjd $ 36 ## 37 38 ## 39 ## Allow ACL and MAC label operations by file descriptor, subject to 40 ## capability rights. Allow MAC label operations on the current process but 41 ## we will need to scope __mac_get_pid(2). 42 ## 43 __acl_aclcheck_fd 44 __acl_delete_fd 45 __acl_get_fd 46 __acl_set_fd 47 __mac_get_fd 48 #__mac_get_pid 49 __mac_get_proc 50 __mac_set_fd 51 __mac_set_proc 52 53 ## 54 ## Allow sysctl(2) as we scope internal to the call; this is a global 55 ## namespace, but there are several critical sysctls required for almost 56 ## anything to run, such as hw.pagesize. For now that policy lives in the 57 ## kernel for performance and simplicity, but perhaps it could move to a 58 ## proxying daemon in userspace. 59 ## 60 __sysctl 61 62 ## 63 ## Allow umtx operations as these are scoped by address space. 64 ## 65 ## XXRW: Need to check this very carefully. 66 ## 67 _umtx_lock 68 _umtx_op 69 _umtx_unlock 70 71 ## 72 ## Allow process termination using abort2(2). 73 ## 74 abort2 75 76 ## 77 ## Allow accept(2) since it doesn't manipulate namespaces directly, rather 78 ## relies on existing bindings on a socket, subject to capability rights. 79 ## 80 accept 81 accept4 82 83 ## 84 ## Allow AIO operations by file descriptor, subject to capability rights. 85 ## 86 aio_cancel 87 aio_error 88 aio_fsync 89 aio_read 90 aio_return 91 aio_suspend 92 aio_waitcomplete 93 aio_write 94 95 ## 96 ## audit(2) is a global operation, submitting to the global trail, but it is 97 ## controlled by privilege, and it might be useful to be able to submit 98 ## records from sandboxes. For now, disallow, but we may want to think about 99 ## providing some sort of proxy service for this. 100 ## 101 #audit 102 103 ## 104 ## Allow bindat(2). 105 ## 106 bindat 107 108 ## 109 ## Allow capability mode and capability system calls. 110 ## 111 cap_enter 112 cap_fcntls_get 113 cap_fcntls_limit 114 cap_getmode 115 cap_ioctls_get 116 cap_ioctls_limit 117 __cap_rights_get 118 cap_rights_limit 119 120 ## 121 ## Allow read-only clock operations. 122 ## 123 clock_getres 124 clock_gettime 125 126 ## 127 ## Always allow file descriptor close(2). 128 ## 129 close 130 closefrom 131 132 ## 133 ## Allow connectat(2). 134 ## 135 connectat 136 137 ## 138 ## cpuset(2) and related calls require scoping by process, but should 139 ## eventually be allowed, at least in the current process case. 140 ## 141 #cpuset 142 #cpuset_getaffinity 143 #cpuset_getid 144 #cpuset_setaffinity 145 #cpuset_setid 146 147 ## 148 ## Always allow dup(2) and dup2(2) manipulation of the file descriptor table. 149 ## 150 dup 151 dup2 152 153 ## 154 ## Allow extended attribute operations by file descriptor, subject to 155 ## capability rights. 156 ## 157 extattr_delete_fd 158 extattr_get_fd 159 extattr_list_fd 160 extattr_set_fd 161 162 ## 163 ## Allow changing file flags, mode, and owner by file descriptor, subject to 164 ## capability rights. 165 ## 166 fchflags 167 fchmod 168 fchown 169 170 ## 171 ## For now, allow fcntl(2), subject to capability rights, but this probably 172 ## needs additional scoping. 173 ## 174 fcntl 175 176 ## 177 ## Allow fexecve(2), subject to capability rights. We perform some scoping, 178 ## such as disallowing privilege escalation. 179 ## 180 fexecve 181 182 ## 183 ## Allow flock(2), subject to capability rights. 184 ## 185 flock 186 187 ## 188 ## Allow fork(2), even though it returns pids -- some applications seem to 189 ## prefer this interface. 190 ## 191 fork 192 193 ## 194 ## Allow fpathconf(2), subject to capability rights. 195 ## 196 fpathconf 197 198 ## 199 ## Allow various file descriptor-based I/O operations, subject to capability 200 ## rights. 201 ## 202 freebsd6_ftruncate 203 freebsd6_lseek 204 freebsd6_mmap 205 freebsd6_pread 206 freebsd6_pwrite 207 208 ## 209 ## Allow querying file and file system state with fstat(2) and fstatfs(2), 210 ## subject to capability rights. 211 ## 212 fstat 213 fstatfs 214 215 ## 216 ## Allow further file descriptor-based I/O operations, subject to capability 217 ## rights. 218 ## 219 fsync 220 ftruncate 221 222 ## 223 ## Allow futimes(2), subject to capability rights. 224 ## 225 futimes 226 227 ## 228 ## Allow querying process audit state, subject to normal access control. 229 ## 230 getaudit 231 getaudit_addr 232 getauid 233 234 ## 235 ## Allow thread context management with getcontext(2). 236 ## 237 getcontext 238 239 ## 240 ## Allow directory I/O on a file descriptor, subject to capability rights. 241 ## Originally we had separate capabilities for directory-specific read 242 ## operations, but on BSD we allow reading the raw directory data, so we just 243 ## rely on CAP_READ now. 244 ## 245 getdents 246 getdirentries 247 248 ## 249 ## Allow querying certain trivial global state. 250 ## 251 getdomainname 252 253 ## 254 ## Allow querying current process credential state. 255 ## 256 getegid 257 geteuid 258 259 ## 260 ## Allow querying certain trivial global state. 261 ## 262 gethostid 263 gethostname 264 265 ## 266 ## Allow querying per-process timer. 267 ## 268 getitimer 269 270 ## 271 ## Allow querying current process credential state. 272 ## 273 getgid 274 getgroups 275 getlogin 276 277 ## 278 ## Allow querying certain trivial global state. 279 ## 280 getpagesize 281 getpeername 282 283 ## 284 ## Allow querying certain per-process scheduling, resource limit, and 285 ## credential state. 286 ## 287 ## XXXRW: getpgid(2) needs scoping. It's not clear if it's worth scoping 288 ## getppid(2). getpriority(2) needs scoping. getrusage(2) needs scoping. 289 ## getsid(2) needs scoping. 290 ## 291 getpgid 292 getpgrp 293 getpid 294 getppid 295 getpriority 296 getresgid 297 getresuid 298 getrlimit 299 getrusage 300 getsid 301 302 ## 303 ## Allow querying socket state, subject to capability rights. 304 ## 305 ## XXXRW: getsockopt(2) may need more attention. 306 ## 307 getsockname 308 getsockopt 309 310 ## 311 ## Allow querying the global clock. 312 ## 313 gettimeofday 314 315 ## 316 ## Allow querying current process credential state. 317 ## 318 getuid 319 320 ## 321 ## Allow ioctl(2), which hopefully will be limited by applications only to 322 ## required commands with cap_ioctls_limit(2) syscall. 323 ## 324 ioctl 325 326 ## 327 ## Allow querying current process credential state. 328 ## 329 issetugid 330 331 ## 332 ## Allow kevent(2), as we will authorize based on capability rights on the 333 ## target descriptor. 334 ## 335 kevent 336 337 ## 338 ## Allow kill(2), as we allow the process to send signals only to himself. 339 ## 340 kill 341 342 ## 343 ## Allow message queue operations on file descriptors, subject to capability 344 ## rights. 345 ## 346 kmq_notify 347 kmq_setattr 348 kmq_timedreceive 349 kmq_timedsend 350 351 ## 352 ## Allow kqueue(2), we will control use. 353 ## 354 kqueue 355 356 ## 357 ## Allow managing per-process timers. 358 ## 359 ktimer_create 360 ktimer_delete 361 ktimer_getoverrun 362 ktimer_gettime 363 ktimer_settime 364 365 ## 366 ## We can't allow ktrace(2) because it relies on a global namespace, but we 367 ## might want to introduce an fktrace(2) of some sort. 368 ## 369 #ktrace 370 371 ## 372 ## Allow AIO operations by file descriptor, subject to capability rights. 373 ## 374 lio_listio 375 376 ## 377 ## Allow listen(2), subject to capability rights. 378 ## 379 ## XXXRW: One might argue this manipulates a global namespace. 380 ## 381 listen 382 383 ## 384 ## Allow I/O-related file descriptors, subject to capability rights. 385 ## 386 lseek 387 388 ## 389 ## Allow MAC label operations by file descriptor, subject to capability 390 ## rights. 391 ## 392 mac_get_fd 393 mac_set_fd 394 395 ## 396 ## Allow simple VM operations on the current process. 397 ## 398 madvise 399 mincore 400 minherit 401 mlock 402 mlockall 403 404 ## 405 ## Allow memory mapping a file descriptor, and updating protections, subject 406 ## to capability rights. 407 ## 408 mmap 409 mprotect 410 411 ## 412 ## Allow simple VM operations on the current process. 413 ## 414 msync 415 munlock 416 munlockall 417 munmap 418 419 ## 420 ## Allow the current process to sleep. 421 ## 422 nanosleep 423 424 ## 425 ## Allow querying the global clock. 426 ## 427 ntp_gettime 428 429 ## 430 ## Allow AIO operations by file descriptor, subject to capability rights. 431 ## 432 oaio_read 433 oaio_write 434 435 ## 436 ## Allow simple VM operations on the current process. 437 ## 438 obreak 439 440 ## 441 ## Allow AIO operations by file descriptor, subject to capability rights. 442 ## 443 olio_listio 444 445 ## 446 ## Operations relative to directory capabilities. 447 ## 448 chflagsat 449 faccessat 450 fchmodat 451 fchownat 452 fstatat 453 futimesat 454 linkat 455 mkdirat 456 mkfifoat 457 mknodat 458 openat 459 readlinkat 460 renameat 461 symlinkat 462 unlinkat 463 464 ## 465 ## Allow entry into open(2). This system call will fail, since access to the 466 ## global file namespace has been disallowed, but allowing entry into the 467 ## syscall means that an audit trail will be generated (which is also very 468 ## useful for debugging). 469 ## 470 open 471 472 ## 473 ## Allow poll(2), which will be scoped by capability rights. 474 ## 475 ## XXXRW: Perhaps we don't need the OpenBSD version? 476 ## XXXRW: We don't yet do that scoping. 477 ## 478 openbsd_poll 479 480 ## 481 ## Process descriptor-related system calls are allowed. 482 ## 483 pdfork 484 pdgetpid 485 pdkill 486 #pdwait4 # not yet implemented 487 488 ## 489 ## Allow pipe(2). 490 ## 491 pipe 492 pipe2 493 494 ## 495 ## Allow poll(2), which will be scoped by capability rights. 496 ## XXXRW: We don't yet do that scoping. 497 ## 498 poll 499 500 ## 501 ## Allow I/O-related file descriptors, subject to capability rights. 502 ## 503 pread 504 preadv 505 506 ## 507 ## Allow access to profiling state on the current process. 508 ## 509 profil 510 511 ## 512 ## Disallow ptrace(2) for now, but we do need debugging facilities in 513 ## capability mode, so we will want to revisit this, possibly by scoping its 514 ## operation. 515 ## 516 #ptrace 517 518 ## 519 ## Allow I/O-related file descriptors, subject to capability rights. 520 ## 521 pwrite 522 pwritev 523 read 524 readv 525 recv 526 recvfrom 527 recvmsg 528 529 ## 530 ## Allow real-time scheduling primitives to be used. 531 ## 532 ## XXXRW: These require scoping. 533 ## 534 rtprio 535 rtprio_thread 536 537 ## 538 ## Allow simple VM operations on the current process. 539 ## 540 sbrk 541 542 ## 543 ## Allow querying trivial global scheduler state. 544 ## 545 sched_get_priority_max 546 sched_get_priority_min 547 548 ## 549 ## Allow various thread/process scheduler operations. 550 ## 551 ## XXXRW: Some of these require further scoping. 552 ## 553 sched_getparam 554 sched_getscheduler 555 sched_rr_getinterval 556 sched_setparam 557 sched_setscheduler 558 sched_yield 559 560 ## 561 ## Allow I/O-related file descriptors, subject to capability rights. 562 ## 563 sctp_generic_recvmsg 564 sctp_generic_sendmsg 565 sctp_generic_sendmsg_iov 566 sctp_peeloff 567 568 ## 569 ## Allow select(2), which will be scoped by capability rights. 570 ## 571 ## XXXRW: But is it? 572 ## 573 select 574 575 ## 576 ## Allow I/O-related file descriptors, subject to capability rights. Use of 577 ## explicit addresses here is restricted by the system calls themselves. 578 ## 579 send 580 sendfile 581 sendmsg 582 sendto 583 584 ## 585 ## Allow setting per-process audit state, which is controlled separately by 586 ## privileges. 587 ## 588 setaudit 589 setaudit_addr 590 setauid 591 592 ## 593 ## Allow setting thread context. 594 ## 595 setcontext 596 597 ## 598 ## Allow setting current process credential state, which is controlled 599 ## separately by privilege. 600 ## 601 setegid 602 seteuid 603 setgid 604 605 ## 606 ## Allow use of the process interval timer. 607 ## 608 setitimer 609 610 ## 611 ## Allow setpriority(2). 612 ## 613 ## XXXRW: Requires scoping. 614 ## 615 setpriority 616 617 ## 618 ## Allow setting current process credential state, which is controlled 619 ## separately by privilege. 620 ## 621 setregid 622 setresgid 623 setresuid 624 setreuid 625 626 ## 627 ## Allow setting process resource limits with setrlimit(2). 628 ## 629 setrlimit 630 631 ## 632 ## Allow creating a new session with setsid(2). 633 ## 634 setsid 635 636 ## 637 ## Allow setting socket options with setsockopt(2), subject to capability 638 ## rights. 639 ## 640 ## XXXRW: Might require scoping. 641 ## 642 setsockopt 643 644 ## 645 ## Allow setting current process credential state, which is controlled 646 ## separately by privilege. 647 ## 648 setuid 649 650 ## 651 ## shm_open(2) is scoped so as to allow only access to new anonymous objects. 652 ## 653 shm_open 654 655 ## 656 ## Allow I/O-related file descriptors, subject to capability rights. 657 ## 658 shutdown 659 660 ## 661 ## Allow signal control on current process. 662 ## 663 sigaction 664 sigaltstack 665 sigblock 666 sigpending 667 sigprocmask 668 sigqueue 669 sigreturn 670 sigsetmask 671 sigstack 672 sigsuspend 673 sigtimedwait 674 sigvec 675 sigwaitinfo 676 677 ## 678 ## Allow creating new socket pairs with socket(2) and socketpair(2). 679 ## 680 socket 681 socketpair 682 683 ## 684 ## Allow simple VM operations on the current process. 685 ## 686 ## XXXRW: Kernel doesn't implement this, so drop? 687 ## 688 sstk 689 690 ## 691 ## Do allow sync(2) for now, but possibly shouldn't. 692 ## 693 sync 694 695 ## 696 ## Always allow process termination with sys_exit(2). 697 ## 698 sys_exit 699 700 ## 701 ## sysarch(2) does rather diverse things, but is required on at least i386 702 ## in order to configure per-thread data. As such, it's scoped on each 703 ## architecture. 704 ## 705 sysarch 706 707 ## 708 ## Allow thread operations operating only on current process. 709 ## 710 thr_create 711 thr_exit 712 thr_kill 713 714 ## 715 ## Disallow thr_kill2(2), as it may operate beyond the current process. 716 ## 717 ## XXXRW: Requires scoping. 718 ## 719 #thr_kill2 720 721 ## 722 ## Allow thread operations operating only on current process. 723 ## 724 thr_new 725 thr_self 726 thr_set_name 727 thr_suspend 728 thr_wake 729 730 ## 731 ## Allow manipulation of the current process umask with umask(2). 732 ## 733 umask 734 735 ## 736 ## Allow submitting of process trace entries with utrace(2). 737 ## 738 utrace 739 740 ## 741 ## Allow generating UUIDs with uuidgen(2). 742 ## 743 uuidgen 744 745 ## 746 ## Allow I/O-related file descriptors, subject to capability rights. 747 ## 748 write 749 writev 750 751 ## 752 ## Allow processes to yield(2). 753 ## 754 yield
Cache object: 6e130dfcb774d392d80e3c51a27fc86d
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]