1*8ac5aef8SEnji Cooper #ifndef __CAPSICUM_FREEBSD_H__ 2*8ac5aef8SEnji Cooper #define __CAPSICUM_FREEBSD_H__ 3*8ac5aef8SEnji Cooper #ifdef __FreeBSD__ 4*8ac5aef8SEnji Cooper /************************************************************ 5*8ac5aef8SEnji Cooper * FreeBSD Capsicum Functionality. 6*8ac5aef8SEnji Cooper ************************************************************/ 7*8ac5aef8SEnji Cooper 8*8ac5aef8SEnji Cooper #ifdef __cplusplus 9*8ac5aef8SEnji Cooper extern "C" { 10*8ac5aef8SEnji Cooper #endif 11*8ac5aef8SEnji Cooper 12*8ac5aef8SEnji Cooper /* FreeBSD definitions. */ 13*8ac5aef8SEnji Cooper #include <errno.h> 14*8ac5aef8SEnji Cooper #include <sys/param.h> 15*8ac5aef8SEnji Cooper #if __FreeBSD_version >= 1100014 || \ 16*8ac5aef8SEnji Cooper (__FreeBSD_version >= 1001511 && __FreeBSD_version < 1100000) 17*8ac5aef8SEnji Cooper #include <sys/capsicum.h> 18*8ac5aef8SEnji Cooper #else 19*8ac5aef8SEnji Cooper #include <sys/capability.h> 20*8ac5aef8SEnji Cooper #endif 21*8ac5aef8SEnji Cooper #include <sys/procdesc.h> 22*8ac5aef8SEnji Cooper 23*8ac5aef8SEnji Cooper #if __FreeBSD_version >= 1000000 24*8ac5aef8SEnji Cooper #define AT_SYSCALLS_IN_CAPMODE 25*8ac5aef8SEnji Cooper #define HAVE_CAP_RIGHTS_GET 26*8ac5aef8SEnji Cooper #define HAVE_CAP_RIGHTS_LIMIT 27*8ac5aef8SEnji Cooper #define HAVE_PROCDESC_FSTAT 28*8ac5aef8SEnji Cooper #define HAVE_CAP_FCNTLS_LIMIT 29*8ac5aef8SEnji Cooper // fcntl(2) takes int, cap_fcntls_limit(2) takes uint32_t. 30*8ac5aef8SEnji Cooper typedef uint32_t cap_fcntl_t; 31*8ac5aef8SEnji Cooper #define HAVE_CAP_IOCTLS_LIMIT 32*8ac5aef8SEnji Cooper // ioctl(2) and cap_ioctls_limit(2) take unsigned long. 33*8ac5aef8SEnji Cooper typedef unsigned long cap_ioctl_t; 34*8ac5aef8SEnji Cooper 35*8ac5aef8SEnji Cooper #if __FreeBSD_version >= 1101000 36*8ac5aef8SEnji Cooper #define HAVE_OPENAT_INTERMEDIATE_DOTDOT 37*8ac5aef8SEnji Cooper #endif 38*8ac5aef8SEnji Cooper 39*8ac5aef8SEnji Cooper #endif 40*8ac5aef8SEnji Cooper 41*8ac5aef8SEnji Cooper #ifdef __cplusplus 42*8ac5aef8SEnji Cooper } 43*8ac5aef8SEnji Cooper #endif 44*8ac5aef8SEnji Cooper 45*8ac5aef8SEnji Cooper // Use fexecve_() in tests to allow Linux variant to bypass glibc version. 46*8ac5aef8SEnji Cooper #define fexecve_(F, A, E) fexecve(F, A, E) 47*8ac5aef8SEnji Cooper 48*8ac5aef8SEnji Cooper #ifdef ENOTBENEATH 49*8ac5aef8SEnji Cooper #define E_NO_TRAVERSE_CAPABILITY ENOTBENEATH 50*8ac5aef8SEnji Cooper #define E_NO_TRAVERSE_O_BENEATH ENOTBENEATH 51*8ac5aef8SEnji Cooper #else 52*8ac5aef8SEnji Cooper #define E_NO_TRAVERSE_CAPABILITY ENOTCAPABLE 53*8ac5aef8SEnji Cooper #define E_NO_TRAVERSE_O_BENEATH ENOTCAPABLE 54*8ac5aef8SEnji Cooper #endif 55*8ac5aef8SEnji Cooper 56*8ac5aef8SEnji Cooper // FreeBSD limits the number of ioctls in cap_ioctls_limit to 256 57*8ac5aef8SEnji Cooper #define CAP_IOCTLS_LIMIT_MAX 256 58*8ac5aef8SEnji Cooper 59*8ac5aef8SEnji Cooper // Too many links 60*8ac5aef8SEnji Cooper #define E_TOO_MANY_LINKS EMLINK 61*8ac5aef8SEnji Cooper 62*8ac5aef8SEnji Cooper // TODO(FreeBSD): uncomment if/when FreeBSD propagates rights on accept. 63*8ac5aef8SEnji Cooper // FreeBSD does not generate a capability from accept(cap_fd,...). 64*8ac5aef8SEnji Cooper // https://bugs.freebsd.org/201052 65*8ac5aef8SEnji Cooper // #define CAP_FROM_ACCEPT 66*8ac5aef8SEnji Cooper // TODO(FreeBSD): uncomment if/when FreeBSD propagates rights on sctp_peeloff. 67*8ac5aef8SEnji Cooper // FreeBSD does not generate a capability from sctp_peeloff(cap_fd,...). 68*8ac5aef8SEnji Cooper // https://bugs.freebsd.org/201052 69*8ac5aef8SEnji Cooper // #define CAP_FROM_PEELOFF 70*8ac5aef8SEnji Cooper 71*8ac5aef8SEnji Cooper #endif /* __FreeBSD__ */ 72*8ac5aef8SEnji Cooper 73*8ac5aef8SEnji Cooper #endif /*__CAPSICUM_FREEBSD_H__*/ 74