Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/kern/capabilities.conf
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 ## 2 ## Copyright (c) 2008-2010 Robert N. M. Watson 3 ## All rights reserved. 4 ## 5 ## This software was developed at the University of Cambridge Computer 6 ## Laboratory with support from a grant from Google, Inc. 7 ## 8 ## Redistribution and use in source and binary forms, with or without 9 ## modification, are permitted provided that the following conditions 10 ## are met: 11 ## 1. Redistributions of source code must retain the above copyright 12 ## notice, this list of conditions and the following disclaimer. 13 ## 2. Redistributions in binary form must reproduce the above copyright 14 ## notice, this list of conditions and the following disclaimer in the 15 ## documentation and/or other materials provided with the distribution. 16 ## 17 ## THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 ## ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 ## IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 ## ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 ## FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 ## DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 ## OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 ## HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 ## LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 ## OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 ## SUCH DAMAGE. 28 ## 29 ## List of system calls enabled in capability mode, one name per line. 30 ## 31 ## Notes: 32 ## - sys_exit(2), abort2(2) and close(2) are very important. 33 ## - Sorted alphabetically, please keep it that way. 34 ## 35 ## $FreeBSD: releng/12.0/sys/kern/capabilities.conf 337998 2018-08-18 06:31:49Z delphij $ 36 ## 37 38 ## 39 ## Allow ACL and MAC label operations by file descriptor, subject to 40 ## capability rights. Allow MAC label operations on the current process but 41 ## we will need to scope __mac_get_pid(2). 42 ## 43 __acl_aclcheck_fd 44 __acl_delete_fd 45 __acl_get_fd 46 __acl_set_fd 47 __mac_get_fd 48 #__mac_get_pid 49 __mac_get_proc 50 __mac_set_fd 51 __mac_set_proc 52 53 ## 54 ## Allow sysctl(2) as we scope internal to the call; this is a global 55 ## namespace, but there are several critical sysctls required for almost 56 ## anything to run, such as hw.pagesize. For now that policy lives in the 57 ## kernel for performance and simplicity, but perhaps it could move to a 58 ## proxying daemon in userspace. 59 ## 60 __sysctl 61 62 ## 63 ## Allow umtx operations as these are scoped by address space. 64 ## 65 ## XXRW: Need to check this very carefully. 66 ## 67 _umtx_op 68 69 ## 70 ## Allow process termination using abort2(2). 71 ## 72 abort2 73 74 ## 75 ## Allow accept(2) since it doesn't manipulate namespaces directly, rather 76 ## relies on existing bindings on a socket, subject to capability rights. 77 ## 78 accept 79 accept4 80 81 ## 82 ## Allow AIO operations by file descriptor, subject to capability rights. 83 ## 84 aio_cancel 85 aio_error 86 aio_fsync 87 aio_read 88 aio_return 89 aio_suspend 90 aio_waitcomplete 91 aio_write 92 93 ## 94 ## audit(2) is a global operation, submitting to the global trail, but it is 95 ## controlled by privilege, and it might be useful to be able to submit 96 ## records from sandboxes. For now, disallow, but we may want to think about 97 ## providing some sort of proxy service for this. 98 ## 99 #audit 100 101 ## 102 ## Allow bindat(2). 103 ## 104 bindat 105 106 ## 107 ## Allow capability mode and capability system calls. 108 ## 109 cap_enter 110 cap_fcntls_get 111 cap_fcntls_limit 112 cap_getmode 113 cap_ioctls_get 114 cap_ioctls_limit 115 __cap_rights_get 116 cap_rights_limit 117 118 ## 119 ## Allow read-only clock operations. 120 ## 121 clock_getres 122 clock_gettime 123 124 ## 125 ## Always allow file descriptor close(2). 126 ## 127 close 128 closefrom 129 130 ## 131 ## Allow connectat(2). 132 ## 133 connectat 134 135 ## 136 ## cpuset(2) and related calls are limited to caller's own process/thread. 137 ## 138 #cpuset 139 cpuset_getaffinity 140 #cpuset_getid 141 cpuset_setaffinity 142 #cpuset_setid 143 144 ## 145 ## Always allow dup(2) and dup2(2) manipulation of the file descriptor table. 146 ## 147 dup 148 dup2 149 150 ## 151 ## Allow extended attribute operations by file descriptor, subject to 152 ## capability rights. 153 ## 154 extattr_delete_fd 155 extattr_get_fd 156 extattr_list_fd 157 extattr_set_fd 158 159 ## 160 ## Allow changing file flags, mode, and owner by file descriptor, subject to 161 ## capability rights. 162 ## 163 fchflags 164 fchmod 165 fchown 166 167 ## 168 ## For now, allow fcntl(2), subject to capability rights, but this probably 169 ## needs additional scoping. 170 ## 171 fcntl 172 173 ## 174 ## Allow fexecve(2), subject to capability rights. We perform some scoping, 175 ## such as disallowing privilege escalation. 176 ## 177 fexecve 178 179 ## 180 ## Allow flock(2), subject to capability rights. 181 ## 182 flock 183 184 ## 185 ## Allow fork(2), even though it returns pids -- some applications seem to 186 ## prefer this interface. 187 ## 188 fork 189 190 ## 191 ## Allow fpathconf(2), subject to capability rights. 192 ## 193 fpathconf 194 195 ## 196 ## Allow various file descriptor-based I/O operations, subject to capability 197 ## rights. 198 ## 199 freebsd11_fstat 200 freebsd11_fstatat 201 freebsd11_getdirentries 202 freebsd11_fstatfs 203 freebsd11_mknodat 204 freebsd6_ftruncate 205 freebsd6_lseek 206 freebsd6_mmap 207 freebsd6_pread 208 freebsd6_pwrite 209 210 ## 211 ## Allow querying file and file system state with fstat(2) and fstatfs(2), 212 ## subject to capability rights. 213 ## 214 fstat 215 fstatfs 216 217 ## 218 ## Allow further file descriptor-based I/O operations, subject to capability 219 ## rights. 220 ## 221 fsync 222 ftruncate 223 224 ## 225 ## Allow futimens(2) and futimes(2), subject to capability rights. 226 ## 227 futimens 228 futimes 229 230 ## 231 ## Allow querying process audit state, subject to normal access control. 232 ## 233 getaudit 234 getaudit_addr 235 getauid 236 237 ## 238 ## Allow thread context management with getcontext(2). 239 ## 240 getcontext 241 242 ## 243 ## Allow directory I/O on a file descriptor, subject to capability rights. 244 ## Originally we had separate capabilities for directory-specific read 245 ## operations, but on BSD we allow reading the raw directory data, so we just 246 ## rely on CAP_READ now. 247 ## 248 getdents 249 getdirentries 250 251 ## 252 ## Allow querying certain trivial global state. 253 ## 254 getdomainname 255 256 ## 257 ## Allow querying certain per-process resource limit state. 258 ## 259 getdtablesize 260 261 ## 262 ## Allow querying current process credential state. 263 ## 264 getegid 265 geteuid 266 267 ## 268 ## Allow querying certain trivial global state. 269 ## 270 gethostid 271 gethostname 272 273 ## 274 ## Allow querying per-process timer. 275 ## 276 getitimer 277 278 ## 279 ## Allow querying current process credential state. 280 ## 281 getgid 282 getgroups 283 getlogin 284 285 ## 286 ## Allow querying certain trivial global state. 287 ## 288 getpagesize 289 getpeername 290 291 ## 292 ## Allow querying certain per-process scheduling, resource limit, and 293 ## credential state. 294 ## 295 ## XXXRW: getpgid(2) needs scoping. It's not clear if it's worth scoping 296 ## getppid(2). getpriority(2) needs scoping. getrusage(2) needs scoping. 297 ## getsid(2) needs scoping. 298 ## 299 getpgid 300 getpgrp 301 getpid 302 getppid 303 getpriority 304 getresgid 305 getresuid 306 getrlimit 307 getrusage 308 getsid 309 310 ## 311 ## Allow getrandom 312 ## 313 getrandom 314 315 ## 316 ## Allow querying socket state, subject to capability rights. 317 ## 318 ## XXXRW: getsockopt(2) may need more attention. 319 ## 320 getsockname 321 getsockopt 322 323 ## 324 ## Allow querying the global clock. 325 ## 326 gettimeofday 327 328 ## 329 ## Allow querying current process credential state. 330 ## 331 getuid 332 333 ## 334 ## Allow ioctl(2), which hopefully will be limited by applications only to 335 ## required commands with cap_ioctls_limit(2) syscall. 336 ## 337 ioctl 338 339 ## 340 ## Allow querying current process credential state. 341 ## 342 issetugid 343 344 ## 345 ## Allow kevent(2), as we will authorize based on capability rights on the 346 ## target descriptor. 347 ## 348 kevent 349 350 ## 351 ## Allow kill(2), as we allow the process to send signals only to himself. 352 ## 353 kill 354 355 ## 356 ## Allow message queue operations on file descriptors, subject to capability 357 ## rights. 358 ## NOTE: Corresponding sysents are initialized in sys/kern/uipc_mqueue.c with 359 ## SYF_CAPENABLED. 360 ## 361 kmq_notify 362 kmq_setattr 363 kmq_timedreceive 364 kmq_timedsend 365 366 ## 367 ## Allow kqueue(2), we will control use. 368 ## 369 kqueue 370 371 ## 372 ## Allow managing per-process timers. 373 ## 374 ktimer_create 375 ktimer_delete 376 ktimer_getoverrun 377 ktimer_gettime 378 ktimer_settime 379 380 ## 381 ## We can't allow ktrace(2) because it relies on a global namespace, but we 382 ## might want to introduce an fktrace(2) of some sort. 383 ## 384 #ktrace 385 386 ## 387 ## Allow AIO operations by file descriptor, subject to capability rights. 388 ## 389 lio_listio 390 391 ## 392 ## Allow listen(2), subject to capability rights. 393 ## 394 ## XXXRW: One might argue this manipulates a global namespace. 395 ## 396 listen 397 398 ## 399 ## Allow I/O-related file descriptors, subject to capability rights. 400 ## 401 lseek 402 403 ## 404 ## Allow simple VM operations on the current process. 405 ## 406 madvise 407 mincore 408 minherit 409 mlock 410 mlockall 411 412 ## 413 ## Allow memory mapping a file descriptor, and updating protections, subject 414 ## to capability rights. 415 ## 416 mmap 417 mprotect 418 419 ## 420 ## Allow simple VM operations on the current process. 421 ## 422 msync 423 munlock 424 munlockall 425 munmap 426 427 ## 428 ## Allow the current process to sleep. 429 ## 430 nanosleep 431 432 ## 433 ## Allow querying the global clock. 434 ## 435 ntp_gettime 436 437 ## 438 ## Allow AIO operations by file descriptor, subject to capability rights. 439 ## 440 oaio_read 441 oaio_write 442 443 ## 444 ## Allow simple VM operations on the current process. 445 ## 446 break 447 448 ## 449 ## Allow AIO operations by file descriptor, subject to capability rights. 450 ## 451 olio_listio 452 453 ## 454 ## Operations relative to directory capabilities. 455 ## 456 chflagsat 457 faccessat 458 fchmodat 459 fchownat 460 fstatat 461 futimesat 462 linkat 463 mkdirat 464 mkfifoat 465 mknodat 466 openat 467 readlinkat 468 renameat 469 symlinkat 470 unlinkat 471 utimensat 472 473 ## 474 ## Process descriptor-related system calls are allowed. 475 ## 476 pdfork 477 pdgetpid 478 pdkill 479 #pdwait4 # not yet implemented 480 481 ## 482 ## Allow pipe(2). 483 ## 484 pipe 485 pipe2 486 487 ## 488 ## Allow poll(2), which will be scoped by capability rights. 489 ## XXXRW: We don't yet do that scoping. 490 ## 491 poll 492 493 ## 494 ## Allow I/O-related file descriptors, subject to capability rights. 495 ## 496 posix_fallocate 497 pread 498 preadv 499 500 ## 501 ## Allow access to profiling state on the current process. 502 ## 503 profil 504 505 ## 506 ## Disallow ptrace(2) for now, but we do need debugging facilities in 507 ## capability mode, so we will want to revisit this, possibly by scoping its 508 ## operation. 509 ## 510 #ptrace 511 512 ## 513 ## Allow I/O-related file descriptors, subject to capability rights. 514 ## 515 pwrite 516 pwritev 517 read 518 readv 519 recv 520 recvfrom 521 recvmsg 522 523 ## 524 ## Allow real-time scheduling primitives to be used. 525 ## 526 ## XXXRW: These require scoping. 527 ## 528 rtprio 529 rtprio_thread 530 531 ## 532 ## Allow simple VM operations on the current process. 533 ## 534 sbrk 535 536 ## 537 ## Allow querying trivial global scheduler state. 538 ## 539 sched_get_priority_max 540 sched_get_priority_min 541 542 ## 543 ## Allow various thread/process scheduler operations. 544 ## 545 ## XXXRW: Some of these require further scoping. 546 ## 547 sched_getparam 548 sched_getscheduler 549 sched_rr_get_interval 550 sched_setparam 551 sched_setscheduler 552 sched_yield 553 554 ## 555 ## Allow I/O-related file descriptors, subject to capability rights. 556 ## NOTE: Corresponding sysents are initialized in sys/netinet/sctp_syscalls.c 557 ## with SYF_CAPENABLED. 558 ## 559 sctp_generic_recvmsg 560 sctp_generic_sendmsg 561 sctp_generic_sendmsg_iov 562 sctp_peeloff 563 564 ## 565 ## Allow pselect(2) and select(2), which will be scoped by capability rights. 566 ## 567 ## XXXRW: But is it? 568 ## 569 pselect 570 select 571 572 ## 573 ## Allow I/O-related file descriptors, subject to capability rights. Use of 574 ## explicit addresses here is restricted by the system calls themselves. 575 ## 576 send 577 sendfile 578 sendmsg 579 sendto 580 581 ## 582 ## Allow setting per-process audit state, which is controlled separately by 583 ## privileges. 584 ## 585 setaudit 586 setaudit_addr 587 setauid 588 589 ## 590 ## Allow setting thread context. 591 ## 592 setcontext 593 594 ## 595 ## Allow setting current process credential state, which is controlled 596 ## separately by privilege. 597 ## 598 setegid 599 seteuid 600 setgid 601 602 ## 603 ## Allow use of the process interval timer. 604 ## 605 setitimer 606 607 ## 608 ## Allow setpriority(2). 609 ## 610 ## XXXRW: Requires scoping. 611 ## 612 setpriority 613 614 ## 615 ## Allow setting current process credential state, which is controlled 616 ## separately by privilege. 617 ## 618 setregid 619 setresgid 620 setresuid 621 setreuid 622 623 ## 624 ## Allow setting process resource limits with setrlimit(2). 625 ## 626 setrlimit 627 628 ## 629 ## Allow creating a new session with setsid(2). 630 ## 631 setsid 632 633 ## 634 ## Allow setting socket options with setsockopt(2), subject to capability 635 ## rights. 636 ## 637 ## XXXRW: Might require scoping. 638 ## 639 setsockopt 640 641 ## 642 ## Allow setting current process credential state, which is controlled 643 ## separately by privilege. 644 ## 645 setuid 646 647 ## 648 ## shm_open(2) is scoped so as to allow only access to new anonymous objects. 649 ## 650 shm_open 651 652 ## 653 ## Allow I/O-related file descriptors, subject to capability rights. 654 ## 655 shutdown 656 657 ## 658 ## Allow signal control on current process. 659 ## 660 sigaction 661 sigaltstack 662 sigblock 663 sigpending 664 sigprocmask 665 sigqueue 666 sigreturn 667 sigsetmask 668 sigstack 669 sigsuspend 670 sigtimedwait 671 sigvec 672 sigwaitinfo 673 sigwait 674 675 ## 676 ## Allow creating new socket pairs with socket(2) and socketpair(2). 677 ## 678 socket 679 socketpair 680 681 ## 682 ## Allow simple VM operations on the current process. 683 ## 684 ## XXXRW: Kernel doesn't implement this, so drop? 685 ## 686 sstk 687 688 ## 689 ## Do allow sync(2) for now, but possibly shouldn't. 690 ## 691 sync 692 693 ## 694 ## Always allow process termination with sys_exit(2). 695 ## 696 sys_exit 697 698 ## 699 ## sysarch(2) does rather diverse things, but is required on at least i386 700 ## in order to configure per-thread data. As such, it's scoped on each 701 ## architecture. 702 ## 703 sysarch 704 705 ## 706 ## Allow thread operations operating only on current process. 707 ## 708 thr_create 709 thr_exit 710 thr_kill 711 712 ## 713 ## Disallow thr_kill2(2), as it may operate beyond the current process. 714 ## 715 ## XXXRW: Requires scoping. 716 ## 717 #thr_kill2 718 719 ## 720 ## Allow thread operations operating only on current process. 721 ## 722 thr_new 723 thr_self 724 thr_set_name 725 thr_suspend 726 thr_wake 727 728 ## 729 ## Allow manipulation of the current process umask with umask(2). 730 ## 731 umask 732 733 ## 734 ## Allow submitting of process trace entries with utrace(2). 735 ## 736 utrace 737 738 ## 739 ## Allow generating UUIDs with uuidgen(2). 740 ## 741 uuidgen 742 743 ## 744 ## Allow I/O-related file descriptors, subject to capability rights. 745 ## 746 write 747 writev 748 749 ## 750 ## Allow processes to yield(2). 751 ## 752 yield
Cache object: 8e7bfcc765533b420d0c52b96bb11df2
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]