1 .\" Copyright (c) 2013 The FreeBSD Foundation
2 .\" Copyright (c) 2018 Mariusz Zaborski <oshogbo@FreeBSD.org>
3 .\" All rights reserved.
5 .\" This documentation was written by Pawel Jakub Dawidek under sponsorship
6 .\" from the FreeBSD Foundation.
8 .\" Redistribution and use in source and binary forms, with or without
9 .\" modification, are permitted provided that the following conditions
11 .\" 1. Redistributions of source code must retain the above copyright
12 .\" notice, this list of conditions and the following disclaimer.
13 .\" 2. Redistributions in binary form must reproduce the above copyright
14 .\" notice, this list of conditions and the following disclaimer in the
15 .\" documentation and/or other materials provided with the distribution.
17 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
18 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
21 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
47 .Nd "library for handling application capabilities"
51 .Fd #define WITH_CASPER
57 .Fn cap_wrap "int sock" "int flags"
59 .Fn cap_unwrap "cap_channel_t *chan" "int *flags"
61 .Fn cap_sock "const cap_channel_t *chan"
63 .Fn cap_clone "const cap_channel_t *chan"
65 .Fn cap_close "cap_channel_t *chan"
67 .Fn cap_limit_get "const cap_channel_t *chan" "nvlist_t **limitsp"
69 .Fn cap_limit_set "const cap_channel_t *chan" "nvlist_t *limits"
71 .Fn cap_send_nvlist "const cap_channel_t *chan" "const nvlist_t *nvl"
73 .Fn cap_recv_nvlist "const cap_channel_t *chan"
75 .Fn cap_xfer_nvlist "const cap_channel_t *chan" "nvlist_t *nvl"
77 .Fn cap_service_open "const cap_channel_t *chan" "const char *name"
81 library allows to manage application capabilities through the casper process.
83 The application capability (represented by the
85 type) is a communication channel between the caller and the casper process
86 daemon or an instance of one of its services.
87 A capability to the casper process obtained with the
89 function allows to create capabilities to casper's services via the
95 function opens capability to the casper process.
101 based on the given socket.
102 The function is used when capability is inherited through
106 domain socket as a regular file descriptor and has to be represented as
111 argument defines the channel behavior.
112 The supported flags are:
113 .Bl -ohang -offset indent
115 The communication between process and casper uses no unique version of nvlist.
120 function is the opposite of the
125 structure and returns
127 domain socket associated with it.
131 function clones the given capability.
135 function closes the given capability.
141 domain socket descriptor associated with the given capability for use with
150 function stores current limits of the given capability in the
153 If the function return
159 it means there are no limits set.
163 function sets limits for the given capability.
164 The limits are provided as
166 The exact format depends on the service the capability represents.
170 function sends the given
172 over the given capability.
173 This is low level interface to communicate with casper services.
174 Most services should provide higher level API.
178 function receives the given
180 over the given capability.
184 function sends the given
186 destroys it and receives new
188 in response over the given capability.
189 It does not matter if the function succeeds or fails, the
191 given for sending will always be destroyed once the function returns.
195 function opens casper service of the given name through casper capability
199 The function returns capability that provides access to opened service.
200 Casper supports the following services in the base system:
201 .Bl -tag -width "system.random" -compact -offset indent
204 provides DNS libc compatible API
214 allows to obtain entropy from
228 .Fn cap_recv_nvlist ,
229 .Fn cap_service_open ,
255 functions always succeed.
274 library was implemented by
275 .An Pawel Jakub Dawidek Aq Mt pawel@dawidek.net
276 under sponsorship from the FreeBSD Foundation.
279 new architecture was implemented by
280 .An Mariusz Zaborski Aq Mt oshogbo@FreeBSD.org