18ac5aef8SEnji Cooper #ifndef __CAPSICUM_FREEBSD_H__ 28ac5aef8SEnji Cooper #define __CAPSICUM_FREEBSD_H__ 38ac5aef8SEnji Cooper #ifdef __FreeBSD__ 48ac5aef8SEnji Cooper /************************************************************ 58ac5aef8SEnji Cooper * FreeBSD Capsicum Functionality. 68ac5aef8SEnji Cooper ************************************************************/ 78ac5aef8SEnji Cooper 88ac5aef8SEnji Cooper #ifdef __cplusplus 98ac5aef8SEnji Cooper extern "C" { 108ac5aef8SEnji Cooper #endif 118ac5aef8SEnji Cooper 128ac5aef8SEnji Cooper /* FreeBSD definitions. */ 138ac5aef8SEnji Cooper #include <errno.h> 148ac5aef8SEnji Cooper #include <sys/param.h> 158ac5aef8SEnji Cooper #if __FreeBSD_version >= 1100014 || \ 168ac5aef8SEnji Cooper (__FreeBSD_version >= 1001511 && __FreeBSD_version < 1100000) 178ac5aef8SEnji Cooper #include <sys/capsicum.h> 188ac5aef8SEnji Cooper #else 198ac5aef8SEnji Cooper #include <sys/capability.h> 208ac5aef8SEnji Cooper #endif 218ac5aef8SEnji Cooper #include <sys/procdesc.h> 228ac5aef8SEnji Cooper 238ac5aef8SEnji Cooper #if __FreeBSD_version >= 1000000 248ac5aef8SEnji Cooper #define AT_SYSCALLS_IN_CAPMODE 258ac5aef8SEnji Cooper #define HAVE_CAP_RIGHTS_GET 268ac5aef8SEnji Cooper #define HAVE_CAP_RIGHTS_LIMIT 278ac5aef8SEnji Cooper #define HAVE_PROCDESC_FSTAT 288ac5aef8SEnji Cooper #define HAVE_CAP_FCNTLS_LIMIT 298ac5aef8SEnji Cooper // fcntl(2) takes int, cap_fcntls_limit(2) takes uint32_t. 308ac5aef8SEnji Cooper typedef uint32_t cap_fcntl_t; 318ac5aef8SEnji Cooper #define HAVE_CAP_IOCTLS_LIMIT 328ac5aef8SEnji Cooper // ioctl(2) and cap_ioctls_limit(2) take unsigned long. 338ac5aef8SEnji Cooper typedef unsigned long cap_ioctl_t; 348ac5aef8SEnji Cooper 358ac5aef8SEnji Cooper #if __FreeBSD_version >= 1101000 368ac5aef8SEnji Cooper #define HAVE_OPENAT_INTERMEDIATE_DOTDOT 378ac5aef8SEnji Cooper #endif 388ac5aef8SEnji Cooper 398ac5aef8SEnji Cooper #endif 408ac5aef8SEnji Cooper 418ac5aef8SEnji Cooper #ifdef __cplusplus 428ac5aef8SEnji Cooper } 438ac5aef8SEnji Cooper #endif 448ac5aef8SEnji Cooper 458ac5aef8SEnji Cooper // Use fexecve_() in tests to allow Linux variant to bypass glibc version. 468ac5aef8SEnji Cooper #define fexecve_(F, A, E) fexecve(F, A, E) 478ac5aef8SEnji Cooper 488ac5aef8SEnji Cooper #ifdef ENOTBENEATH 498ac5aef8SEnji Cooper #define E_NO_TRAVERSE_CAPABILITY ENOTBENEATH 508ac5aef8SEnji Cooper #define E_NO_TRAVERSE_O_BENEATH ENOTBENEATH 518ac5aef8SEnji Cooper #else 528ac5aef8SEnji Cooper #define E_NO_TRAVERSE_CAPABILITY ENOTCAPABLE 538ac5aef8SEnji Cooper #define E_NO_TRAVERSE_O_BENEATH ENOTCAPABLE 548ac5aef8SEnji Cooper #endif 558ac5aef8SEnji Cooper 568ac5aef8SEnji Cooper // FreeBSD limits the number of ioctls in cap_ioctls_limit to 256 578ac5aef8SEnji Cooper #define CAP_IOCTLS_LIMIT_MAX 256 588ac5aef8SEnji Cooper 598ac5aef8SEnji Cooper // Too many links 608ac5aef8SEnji Cooper #define E_TOO_MANY_LINKS EMLINK 618ac5aef8SEnji Cooper 626684779bSEd Maste // As of commit 85b0f9de11c3 ("capsicum: propagate rights on accept(2)") 636684779bSEd Maste // FreeBSD generates a capability from accept(cap_fd,...). 646684779bSEd Maste #define CAP_FROM_ACCEPT 65*38518fdaSEd Maste // As of commit 91a9e4e01dab ("capsicum: propagate rights on sctp_peeloff") 66*38518fdaSEd Maste // FreeBSD generates a capability from sctp_peeloff(cap_fd,...). 67*38518fdaSEd Maste #define CAP_FROM_PEELOFF 688ac5aef8SEnji Cooper 698ac5aef8SEnji Cooper #endif /* __FreeBSD__ */ 708ac5aef8SEnji Cooper 718ac5aef8SEnji Cooper #endif /*__CAPSICUM_FREEBSD_H__*/ 72