libcapsicum: document return values

Reviewed by: emaste
Requested by: des
Differential Revision: https://reviews.freebsd.org/D45222

Remove $FreeBSD$: two-line nroff pattern

Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/

capsicum_helpers: split stream cap bits out of caph_limit_stream()

The goal here is to make it so applications can take the rights one would
normally get by calling caph_limit_stream() on a descript

capsicum_helpers: split stream cap bits out of caph_limit_stream()

The goal here is to make it so applications can take the rights one would
normally get by calling caph_limit_stream() on a descriptor and build on
them as needed.

The tentatively planned use-case is an application that takes a socket and
hooks it up to std{err,out,in} for a fork()d child. It may be feasible to
apply limitations to such descriptors as long as it's a superset of those
normally applied to stdio.

Reviewed by: markj, oshobo (prior version; sans manpage addition)
Differential Revision: https://reviews.freebsd.org/D22993

show more ...

List caph_limit_stream() in the synopsis.

Fix typos while here.

MFC after: 1 week
Sponsored by: The FreeBSD Foundation

libcapsicum: Introduce caph_{rights,ioctls,fcntls}_limit

The idea behind those functions is not to force consumers to remember that there
is a need to check errno on failure. We already have a caph_

libcapsicum: Introduce caph_{rights,ioctls,fcntls}_limit

The idea behind those functions is not to force consumers to remember that there
is a need to check errno on failure. We already have a caph_enter(3) function
which does the same for cap_enter(2).

MFC after: 2 weeks

show more ...

Fix description.

Fix declaration.

Introduce caph_enter and caph_enter_casper.

The caph_enter function should made it easier to sandbox application
and not force us to remember that we need to check errno on failure.
Another function

Introduce caph_enter and caph_enter_casper.

The caph_enter function should made it easier to sandbox application
and not force us to remember that we need to check errno on failure.
Another function is also checking if casper is present.

Reviewed by: emaste, cem (partially)
Differential Revision: https://reviews.freebsd.org/D14557

show more ...

Fix few sentence in the man page.

Pointed out by: wblock

Add man pages for Capsicum helpers.

Reviewed by: cem
Differential Revision: https://reviews.freebsd.org/D8154