Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/kern/capabilities.conf
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 ## 2 ## Copyright (c) 2008-2010 Robert N. M. Watson 3 ## All rights reserved. 4 ## 5 ## This software was developed at the University of Cambridge Computer 6 ## Laboratory with support from a grant from Google, Inc. 7 ## 8 ## Redistribution and use in source and binary forms, with or without 9 ## modification, are permitted provided that the following conditions 10 ## are met: 11 ## 1. Redistributions of source code must retain the above copyright 12 ## notice, this list of conditions and the following disclaimer. 13 ## 2. Redistributions in binary form must reproduce the above copyright 14 ## notice, this list of conditions and the following disclaimer in the 15 ## documentation and/or other materials provided with the distribution. 16 ## 17 ## THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 ## ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 ## IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 ## ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 ## FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 ## DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 ## OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 ## HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 ## LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 ## OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 ## SUCH DAMAGE. 28 ## 29 ## List of system calls enabled in capability mode, one name per line. 30 ## 31 ## System calls listed here operate either fully or partially in the absence 32 ## of global namespaces or ambient authority. In capability mode system calls 33 ## that operate only on global namespaces or require ambient authority have no 34 ## utility and thus are not permitted. 35 ## 36 ## Notes: 37 ## - sys_exit(2), abort2(2) and close(2) are very important. 38 ## - Sorted alphabetically, please keep it that way. 39 ## 40 ## $FreeBSD$ 41 ## 42 43 ## 44 ## Allow ACL and MAC label operations by file descriptor, subject to 45 ## capability rights. Allow MAC label operations on the current process but 46 ## we will need to scope __mac_get_pid(2). 47 ## 48 __acl_aclcheck_fd 49 __acl_delete_fd 50 __acl_get_fd 51 __acl_set_fd 52 __mac_get_fd 53 #__mac_get_pid 54 __mac_get_proc 55 __mac_set_fd 56 __mac_set_proc 57 58 ## 59 ## Allow sysctl(2) as we scope internal to the call; this is a global 60 ## namespace, but there are several critical sysctls required for almost 61 ## anything to run, such as hw.pagesize. For now that policy lives in the 62 ## kernel for performance and simplicity, but perhaps it could move to a 63 ## proxying daemon in userspace. 64 ## 65 __sysctl 66 __sysctlbyname 67 68 ## 69 ## Allow umtx operations as these are scoped by address space. 70 ## 71 ## XXRW: Need to check this very carefully. 72 ## 73 _umtx_op 74 75 ## 76 ## Allow process termination using abort2(2). 77 ## 78 abort2 79 80 ## 81 ## Allow accept(2) since it doesn't manipulate namespaces directly, rather 82 ## relies on existing bindings on a socket, subject to capability rights. 83 ## 84 accept 85 accept4 86 87 ## 88 ## Allow AIO operations by file descriptor, subject to capability rights. 89 ## 90 aio_cancel 91 aio_error 92 aio_fsync 93 aio_read 94 aio_return 95 aio_suspend 96 aio_waitcomplete 97 aio_write 98 99 ## 100 ## audit(2) is a global operation, submitting to the global trail, but it is 101 ## controlled by privilege, and it might be useful to be able to submit 102 ## records from sandboxes. For now, disallow, but we may want to think about 103 ## providing some sort of proxy service for this. 104 ## 105 #audit 106 107 ## 108 ## Allow bindat(2). 109 ## 110 bindat 111 112 ## 113 ## Allow capability mode and capability system calls. 114 ## 115 cap_enter 116 cap_fcntls_get 117 cap_fcntls_limit 118 cap_getmode 119 cap_ioctls_get 120 cap_ioctls_limit 121 __cap_rights_get 122 cap_rights_limit 123 124 ## 125 ## Allow read-only clock operations. 126 ## 127 clock_getres 128 clock_gettime 129 130 ## 131 ## Always allow file descriptor close(2). 132 ## 133 close 134 close_range 135 closefrom 136 137 ## 138 ## Allow connectat(2). 139 ## 140 connectat 141 142 ## 143 ## cpuset(2) and related calls are limited to caller's own process/thread. 144 ## 145 #cpuset 146 cpuset_getaffinity 147 cpuset_getdomain 148 #cpuset_getid 149 cpuset_setaffinity 150 cpuset_setdomain 151 #cpuset_setid 152 153 ## 154 ## Always allow dup(2) and dup2(2) manipulation of the file descriptor table. 155 ## 156 dup 157 dup2 158 159 ## 160 ## Allow extended attribute operations by file descriptor, subject to 161 ## capability rights. 162 ## 163 extattr_delete_fd 164 extattr_get_fd 165 extattr_list_fd 166 extattr_set_fd 167 168 ## 169 ## Allow changing file flags, mode, and owner by file descriptor, subject to 170 ## capability rights. 171 ## 172 fchflags 173 fchmod 174 fchown 175 176 ## 177 ## For now, allow fcntl(2), subject to capability rights, but this probably 178 ## needs additional scoping. 179 ## 180 fcntl 181 182 ## 183 ## Allow fexecve(2), subject to capability rights. We perform some scoping, 184 ## such as disallowing privilege escalation. 185 ## 186 fexecve 187 188 ## 189 ## Allow flock(2), subject to capability rights. 190 ## 191 flock 192 193 ## 194 ## Allow fork(2), even though it returns pids -- some applications seem to 195 ## prefer this interface. 196 ## 197 fork 198 199 ## 200 ## Allow fpathconf(2), subject to capability rights. 201 ## 202 fpathconf 203 204 ## 205 ## Allow various file descriptor-based I/O operations, subject to capability 206 ## rights. 207 ## 208 freebsd11_fstat 209 freebsd11_fstatat 210 freebsd11_getdirentries 211 freebsd11_fstatfs 212 freebsd11_mknodat 213 freebsd6_ftruncate 214 freebsd6_lseek 215 freebsd6_mmap 216 freebsd6_pread 217 freebsd6_pwrite 218 219 ## 220 ## Allow querying file and file system state with fstat(2) and fstatfs(2), 221 ## subject to capability rights. 222 ## 223 fstat 224 fstatfs 225 226 ## 227 ## Allow further file descriptor-based I/O operations, subject to capability 228 ## rights. 229 ## 230 fdatasync 231 fsync 232 ftruncate 233 234 ## 235 ## Allow futimens(2) and futimes(2), subject to capability rights. 236 ## 237 futimens 238 futimes 239 240 ## 241 ## Allow querying process audit state, subject to normal access control. 242 ## 243 getaudit 244 getaudit_addr 245 getauid 246 247 ## 248 ## Allow thread context management with getcontext(2). 249 ## 250 getcontext 251 252 ## 253 ## Allow directory I/O on a file descriptor, subject to capability rights. 254 ## Originally we had separate capabilities for directory-specific read 255 ## operations, but on BSD we allow reading the raw directory data, so we just 256 ## rely on CAP_READ now. 257 ## 258 getdents 259 getdirentries 260 261 ## 262 ## Allow querying certain trivial global state. 263 ## 264 getdomainname 265 266 ## 267 ## Allow querying certain per-process resource limit state. 268 ## 269 getdtablesize 270 271 ## 272 ## Allow querying current process credential state. 273 ## 274 getegid 275 geteuid 276 277 ## 278 ## Allow querying certain trivial global state. 279 ## 280 gethostid 281 gethostname 282 283 ## 284 ## Allow querying per-process timer. 285 ## 286 getitimer 287 288 ## 289 ## Allow querying current process credential state. 290 ## 291 getgid 292 getgroups 293 getlogin 294 getloginclass 295 296 ## 297 ## Allow querying certain trivial global state. 298 ## 299 getpagesize 300 getpeername 301 302 ## 303 ## Allow querying certain per-process scheduling, resource limit, and 304 ## credential state. 305 ## 306 ## XXXRW: getpgid(2) needs scoping. It's not clear if it's worth scoping 307 ## getppid(2). getpriority(2) needs scoping. getrusage(2) needs scoping. 308 ## getsid(2) needs scoping. 309 ## 310 getpgid 311 getpgrp 312 getpid 313 getppid 314 getpriority 315 getresgid 316 getresuid 317 getrlimit 318 getrusage 319 getsid 320 321 ## 322 ## Allow getrandom 323 ## 324 getrandom 325 326 ## 327 ## Allow querying socket state, subject to capability rights. 328 ## 329 ## XXXRW: getsockopt(2) may need more attention. 330 ## 331 getsockname 332 getsockopt 333 334 ## 335 ## Allow querying the global clock. 336 ## 337 gettimeofday 338 339 ## 340 ## Allow querying current process credential state. 341 ## 342 getuid 343 344 ## 345 ## Allow ioctl(2), which hopefully will be limited by applications only to 346 ## required commands with cap_ioctls_limit(2) syscall. 347 ## 348 ioctl 349 350 ## 351 ## Allow querying current process credential state. 352 ## 353 issetugid 354 355 ## 356 ## Allow kevent(2), as we will authorize based on capability rights on the 357 ## target descriptor. 358 ## 359 kevent 360 361 ## 362 ## Allow kill(2), as we allow the process to send signals only to himself. 363 ## 364 kill 365 366 ## 367 ## Allow message queue operations on file descriptors, subject to capability 368 ## rights. 369 ## NOTE: Corresponding sysents are initialized in sys/kern/uipc_mqueue.c with 370 ## SYF_CAPENABLED. 371 ## 372 kmq_notify 373 kmq_setattr 374 kmq_timedreceive 375 kmq_timedsend 376 377 ## 378 ## Allow kqueue(2), we will control use. 379 ## 380 kqueue 381 382 ## 383 ## Allow managing per-process timers. 384 ## 385 ktimer_create 386 ktimer_delete 387 ktimer_getoverrun 388 ktimer_gettime 389 ktimer_settime 390 391 ## 392 ## We can't allow ktrace(2) because it relies on a global namespace, but we 393 ## might want to introduce an fktrace(2) of some sort. 394 ## 395 #ktrace 396 397 ## 398 ## Allow AIO operations by file descriptor, subject to capability rights. 399 ## 400 lio_listio 401 402 ## 403 ## Allow listen(2), subject to capability rights. 404 ## 405 ## XXXRW: One might argue this manipulates a global namespace. 406 ## 407 listen 408 409 ## 410 ## Allow I/O-related file descriptors, subject to capability rights. 411 ## 412 lseek 413 414 ## 415 ## Allow simple VM operations on the current process. 416 ## 417 madvise 418 mincore 419 minherit 420 mlock 421 mlockall 422 423 ## 424 ## Allow memory mapping a file descriptor, and updating protections, subject 425 ## to capability rights. 426 ## 427 mmap 428 mprotect 429 430 ## 431 ## Allow simple VM operations on the current process. 432 ## 433 msync 434 munlock 435 munlockall 436 munmap 437 438 ## 439 ## Allow the current process to sleep. 440 ## 441 nanosleep 442 443 ## 444 ## Allow querying the global clock. 445 ## 446 ntp_gettime 447 448 ## 449 ## Allow AIO operations by file descriptor, subject to capability rights. 450 ## 451 oaio_read 452 oaio_write 453 454 ## 455 ## Allow simple VM operations on the current process. 456 ## 457 break 458 459 ## 460 ## Allow AIO operations by file descriptor, subject to capability rights. 461 ## 462 olio_listio 463 464 ## 465 ## Operations relative to directory capabilities. 466 ## 467 chflagsat 468 faccessat 469 fchmodat 470 fchownat 471 fstatat 472 futimesat 473 linkat 474 mkdirat 475 mkfifoat 476 mknodat 477 openat 478 readlinkat 479 renameat 480 symlinkat 481 unlinkat 482 utimensat 483 484 ## 485 ## Process descriptor-related system calls are allowed. 486 ## 487 pdfork 488 pdgetpid 489 pdkill 490 #pdwait4 # not yet implemented 491 492 ## 493 ## Allow pipe(2). 494 ## 495 pipe 496 pipe2 497 498 ## 499 ## Allow poll(2), which will be scoped by capability rights. 500 ## 501 poll 502 ppoll 503 504 ## 505 ## Allow I/O-related file descriptors, subject to capability rights. 506 ## 507 posix_fallocate 508 pread 509 preadv 510 511 ## 512 ## Allow access to profiling state on the current process. 513 ## 514 profil 515 516 ## 517 ## Disallow ptrace(2) for now, but we do need debugging facilities in 518 ## capability mode, so we will want to revisit this, possibly by scoping its 519 ## operation. 520 ## 521 #ptrace 522 523 ## 524 ## Allow I/O-related file descriptors, subject to capability rights. 525 ## 526 pwrite 527 pwritev 528 read 529 readv 530 recv 531 recvfrom 532 recvmsg 533 534 ## 535 ## Allow real-time scheduling primitives to be used. 536 ## 537 ## XXXRW: These require scoping. 538 ## 539 rtprio 540 rtprio_thread 541 542 ## 543 ## Allow simple VM operations on the current process. 544 ## 545 sbrk 546 547 ## 548 ## Allow querying trivial global scheduler state. 549 ## 550 sched_get_priority_max 551 sched_get_priority_min 552 553 ## 554 ## Allow various thread/process scheduler operations. 555 ## 556 ## XXXRW: Some of these require further scoping. 557 ## 558 sched_getparam 559 sched_getscheduler 560 sched_rr_get_interval 561 sched_setparam 562 sched_setscheduler 563 sched_yield 564 565 ## 566 ## Allow I/O-related file descriptors, subject to capability rights. 567 ## NOTE: Corresponding sysents are initialized in sys/netinet/sctp_syscalls.c 568 ## with SYF_CAPENABLED. 569 ## 570 sctp_generic_recvmsg 571 sctp_generic_sendmsg 572 sctp_generic_sendmsg_iov 573 sctp_peeloff 574 575 ## 576 ## Allow pselect(2) and select(2), which will be scoped by capability rights. 577 ## 578 ## XXXRW: But is it? 579 ## 580 pselect 581 select 582 583 ## 584 ## Allow I/O-related file descriptors, subject to capability rights. Use of 585 ## explicit addresses here is restricted by the system calls themselves. 586 ## 587 send 588 sendfile 589 sendmsg 590 sendto 591 592 ## 593 ## Allow setting per-process audit state, which is controlled separately by 594 ## privileges. 595 ## 596 setaudit 597 setaudit_addr 598 setauid 599 600 ## 601 ## Allow setting thread context. 602 ## 603 setcontext 604 605 ## 606 ## Allow setting current process credential state, which is controlled 607 ## separately by privilege. 608 ## 609 setegid 610 seteuid 611 setgid 612 613 ## 614 ## Allow use of the process interval timer. 615 ## 616 setitimer 617 618 ## 619 ## Allow setpriority(2). 620 ## 621 ## XXXRW: Requires scoping. 622 ## 623 setpriority 624 625 ## 626 ## Allow setting current process credential state, which is controlled 627 ## separately by privilege. 628 ## 629 setregid 630 setresgid 631 setresuid 632 setreuid 633 634 ## 635 ## Allow setting process resource limits with setrlimit(2). 636 ## 637 setrlimit 638 639 ## 640 ## Allow creating a new session with setsid(2). 641 ## 642 setsid 643 644 ## 645 ## Allow setting socket options with setsockopt(2), subject to capability 646 ## rights. 647 ## 648 ## XXXRW: Might require scoping. 649 ## 650 setsockopt 651 652 ## 653 ## Allow setting current process credential state, which is controlled 654 ## separately by privilege. 655 ## 656 setuid 657 658 ## 659 ## shm_open(2) is scoped so as to allow only access to new anonymous objects. 660 ## 661 shm_open 662 663 ## 664 ## Allow I/O-related file descriptors, subject to capability rights. 665 ## 666 shutdown 667 668 ## 669 ## Allow signal control on current process. 670 ## 671 sigaction 672 sigaltstack 673 sigblock 674 sigpending 675 sigprocmask 676 sigqueue 677 sigreturn 678 sigsetmask 679 sigstack 680 sigsuspend 681 sigtimedwait 682 sigvec 683 sigwaitinfo 684 sigwait 685 686 ## 687 ## Allow creating new socket pairs with socket(2) and socketpair(2). 688 ## 689 socket 690 socketpair 691 692 ## 693 ## Allow simple VM operations on the current process. 694 ## 695 ## XXXRW: Kernel doesn't implement this, so drop? 696 ## 697 sstk 698 699 ## 700 ## Do allow sync(2) for now, but possibly shouldn't. 701 ## 702 sync 703 704 ## 705 ## Always allow process termination with sys_exit(2). 706 ## 707 sys_exit 708 709 ## 710 ## sysarch(2) does rather diverse things, but is required on at least i386 711 ## in order to configure per-thread data. As such, it's scoped on each 712 ## architecture. 713 ## 714 sysarch 715 716 ## 717 ## Allow thread operations operating only on current process. 718 ## 719 thr_create 720 thr_exit 721 thr_kill 722 723 ## 724 ## Disallow thr_kill2(2), as it may operate beyond the current process. 725 ## 726 ## XXXRW: Requires scoping. 727 ## 728 #thr_kill2 729 730 ## 731 ## Allow thread operations operating only on current process. 732 ## 733 thr_new 734 thr_self 735 thr_set_name 736 thr_suspend 737 thr_wake 738 739 ## 740 ## Allow manipulation of the current process umask with umask(2). 741 ## 742 umask 743 744 ## 745 ## Allow submitting of process trace entries with utrace(2). 746 ## 747 utrace 748 749 ## 750 ## Allow generating UUIDs with uuidgen(2). 751 ## 752 uuidgen 753 754 ## 755 ## Allow I/O-related file descriptors, subject to capability rights. 756 ## 757 write 758 writev 759 760 ## 761 ## Allow processes to yield(2). 762 ## 763 yield
Cache object: 90a473981a17a3456607f64707f34c93
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]