aboutsummaryrefslogtreecommitdiff
path: root/sys/kern/capabilities.conf
blob: 602ec7088fc67fc522b38c137f2fbae26873ed5d (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
##
## Copyright (c) 2008-2010 Robert N. M. Watson
## All rights reserved.
##
## This software was developed at the University of Cambridge Computer
## Laboratory with support from a grant from Google, Inc.
##
## Redistribution and use in source and binary forms, with or without
## modification, are permitted provided that the following conditions
## are met:
## 1. Redistributions of source code must retain the above copyright
##    notice, this list of conditions and the following disclaimer.
## 2. Redistributions in binary form must reproduce the above copyright
##    notice, this list of conditions and the following disclaimer in the
##    documentation and/or other materials provided with the distribution.
##
## THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
## ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
## IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
## ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
## FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
## DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
## OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
## HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
## LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
## OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
## SUCH DAMAGE.
##
## List of system calls enabled in capability mode, one name per line.
##
## System calls listed here operate either fully or partially in the absence
## of global namespaces or ambient authority.  In capability mode system calls
## that operate only on global namespaces or require ambient authority have no
## utility and thus are not permitted.
##
## Notes:
## - sys_exit(2), abort2(2) and close(2) are very important.
## - Sorted alphabetically, please keep it that way.
##
## $FreeBSD$
##

##
## Allow ACL and MAC label operations by file descriptor, subject to
## capability rights.  Allow MAC label operations on the current process but
## we will need to scope __mac_get_pid(2).
##
__acl_aclcheck_fd
__acl_delete_fd
__acl_get_fd
__acl_set_fd
__mac_get_fd
#__mac_get_pid
__mac_get_proc
__mac_set_fd
__mac_set_proc

##
## Allow creating special file descriptors like eventfd(2).
##
__specialfd

##
## Allow sysctl(2) as we scope internal to the call; this is a global
## namespace, but there are several critical sysctls required for almost
## anything to run, such as hw.pagesize.  For now that policy lives in the
## kernel for performance and simplicity, but perhaps it could move to a
## proxying daemon in userspace.
##
__sysctl
__sysctlbyname

##
## Allow umtx operations as these are scoped by address space.
##
## XXRW: Need to check this very carefully.
##
_umtx_op

##
## Allow process termination using abort2(2).
##
abort2

##
## Allow accept(2) since it doesn't manipulate namespaces directly, rather
## relies on existing bindings on a socket, subject to capability rights.
##
accept
accept4

##
## Allow AIO operations by file descriptor, subject to capability rights.
##
aio_cancel
aio_error
aio_fsync
aio_read
aio_return
aio_suspend
aio_waitcomplete
aio_write
aio_writev
aio_readv

##
## audit(2) is a global operation, submitting to the global trail, but it is
## controlled by privilege, and it might be useful to be able to submit
## records from sandboxes.  For now, disallow, but we may want to think about
## providing some sort of proxy service for this.
##
#audit

##
## Allow bindat(2).
##
bindat

##
## Allow capability mode and capability system calls.
##
cap_enter
cap_fcntls_get
cap_fcntls_limit
cap_getmode
cap_ioctls_get
cap_ioctls_limit
__cap_rights_get
cap_rights_limit

##
## Allow read-only clock operations.
##
clock_getres
clock_gettime

##
## Always allow file descriptor close(2).
##
close
close_range
closefrom

##
## Allow connectat(2).
##
connectat

##
## copy_file_range(2) reads from one descriptor and writes to the other.
##
copy_file_range

##
## cpuset(2) and related calls are limited to caller's own process/thread.
##
#cpuset
cpuset_getaffinity
cpuset_getdomain
#cpuset_getid
cpuset_setaffinity
cpuset_setdomain
#cpuset_setid

##
## Always allow dup(2) and dup2(2) manipulation of the file descriptor table.
##
dup
dup2

##
## Allow extended attribute operations by file descriptor, subject to
## capability rights.
##
extattr_delete_fd
extattr_get_fd
extattr_list_fd
extattr_set_fd

##
## Allow changing file flags, mode, and owner by file descriptor, subject to
## capability rights.
##
fchflags
fchmod
fchown

##
## For now, allow fcntl(2), subject to capability rights, but this probably
## needs additional scoping.
##
fcntl

##
## Allow fexecve(2), subject to capability rights.  We perform some scoping,
## such as disallowing privilege escalation.
##
fexecve

##
## Allow flock(2), subject to capability rights.
##
flock

##
## Allow fork(2), even though it returns pids -- some applications seem to
## prefer this interface.
##
fork

##
## Allow fpathconf(2), subject to capability rights.
##
fpathconf

##
## Allow various file descriptor-based I/O operations, subject to capability
## rights.
##
freebsd11_fstat
freebsd11_fstatat
freebsd11_getdirentries
freebsd11_fstatfs
freebsd11_mknodat
freebsd6_ftruncate
freebsd6_lseek
freebsd6_mmap
freebsd6_pread
freebsd6_pwrite

##
## Allow querying file and file system state with fstat(2) and fstatfs(2),
## subject to capability rights.
##
fstat
fstatfs

##
## Allow further file descriptor-based I/O operations, subject to capability
## rights.
##
fdatasync
fsync
ftruncate

##
## Allow futimens(2) and futimes(2), subject to capability rights.
##
futimens
futimes

##
## Allow querying process audit state, subject to normal access control.
##
getaudit
getaudit_addr
getauid

##
## Allow thread context management with getcontext(2).
##
getcontext

##
## Allow directory I/O on a file descriptor, subject to capability rights.
## Originally we had separate capabilities for directory-specific read
## operations, but on BSD we allow reading the raw directory data, so we just
## rely on CAP_READ now.
##
getdents
getdirentries

##
## Allow querying certain trivial global state.
##
getdomainname

##
## Allow querying certain per-process resource limit state.
##
getdtablesize

##
## Allow querying current process credential state.
##
getegid
geteuid

##
## Allow querying certain trivial global state.
##
gethostid
gethostname

##
## Allow querying per-process timer.
##
getitimer

##
## Allow querying current process credential state.
##
getgid
getgroups
getlogin
getloginclass

##
## Allow querying certain trivial global state.
##
getpagesize
getpeername

##
## Allow querying certain per-process scheduling, resource limit, and
## credential state.
##
## XXXRW: getpgid(2) needs scoping.  It's not clear if it's worth scoping
## getppid(2).  getpriority(2) needs scoping.  getrusage(2) needs scoping.
## getsid(2) needs scoping.
##
getpgid
getpgrp
getpid
getppid
getpriority
getresgid
getresuid
getrlimit
getrusage
getsid

##
## Allow getrandom
##
getrandom

##
## Allow querying socket state, subject to capability rights.
##
## XXXRW: getsockopt(2) may need more attention.
##
getsockname
getsockopt

##
## Allow querying the global clock.
##
gettimeofday

##
## Allow querying current process credential state.
##
getuid

##
## Allow ioctl(2), which hopefully will be limited by applications only to
## required commands with cap_ioctls_limit(2) syscall.
##
ioctl

##
## Allow querying current process credential state.
##
issetugid

##
## Allow kevent(2), as we will authorize based on capability rights on the
## target descriptor.
##
kevent

##
## Allow kill(2), as we allow the process to send signals only to himself.
##
kill

##
## Allow message queue operations on file descriptors, subject to capability
## rights.
## NOTE: Corresponding sysents are initialized in sys/kern/uipc_mqueue.c with
## SYF_CAPENABLED.
##
kmq_notify
kmq_setattr
kmq_timedreceive
kmq_timedsend

##
## Allow kqueue(2), we will control use.
##
kqueue

##
## Allow managing per-process timers.
##
ktimer_create
ktimer_delete
ktimer_getoverrun
ktimer_gettime
ktimer_settime

##
## We can't allow ktrace(2) because it relies on a global namespace, but we
## might want to introduce an fktrace(2) of some sort.
##
#ktrace

##
## Allow AIO operations by file descriptor, subject to capability rights.
##
lio_listio

##
## Allow listen(2), subject to capability rights.
##
## XXXRW: One might argue this manipulates a global namespace.
##
listen

##
## Allow I/O-related file descriptors, subject to capability rights.
##
lseek

##
## Allow simple VM operations on the current process.
##
madvise
mincore
minherit
mlock
mlockall

##
## Allow memory mapping a file descriptor, and updating protections, subject
## to capability rights.
##
mmap
mprotect

##
## Allow simple VM operations on the current process.
##
msync
munlock
munlockall
munmap

##
## Allow the current process to sleep.
##
nanosleep

##
## Allow querying the global clock.
##
ntp_gettime

##
## Allow AIO operations by file descriptor, subject to capability rights.
##
oaio_read
oaio_write

##
## Allow simple VM operations on the current process.
##
break

##
## Allow AIO operations by file descriptor, subject to capability rights.
##
olio_listio

##
## Operations relative to directory capabilities.
##
chflagsat
faccessat
fchmodat
fchownat
fstatat
futimesat
linkat
mkdirat
mkfifoat
mknodat
openat
readlinkat
renameat
symlinkat
unlinkat
funlinkat
utimensat

##
## Process descriptor-related system calls are allowed.
##
pdfork
pdgetpid
pdkill
#pdwait4	# not yet implemented

##
## Allow pipe(2).
##
pipe
pipe2

##
## Allow poll(2), which will be scoped by capability rights.
##
poll
ppoll

##
## Allow I/O-related file descriptors, subject to capability rights.
##
posix_fallocate
pread
preadv

##
## Allow access to profiling state on the current process.
##
profil

##
## Disallow ptrace(2) for now, but we do need debugging facilities in
## capability mode, so we will want to revisit this, possibly by scoping its
## operation.
##
#ptrace

##
## Allow I/O-related file descriptors, subject to capability rights.
##
pwrite
pwritev
read
readv
recv
recvfrom
recvmsg

##
## Allow real-time scheduling primitives to be used.
##
## XXXRW: These require scoping.
##
rtprio
rtprio_thread

##
## Allow simple VM operations on the current process.
##
sbrk

##
## Allow querying trivial global scheduler state.
##
sched_get_priority_max
sched_get_priority_min

##
## Allow various thread/process scheduler operations.
##
## XXXRW: Some of these require further scoping.
##
sched_getparam
sched_getscheduler
sched_rr_get_interval
sched_setparam
sched_setscheduler
sched_yield

##
## Allow I/O-related file descriptors, subject to capability rights.
## NOTE: Corresponding sysents are initialized in sys/netinet/sctp_syscalls.c
## with SYF_CAPENABLED.
##
sctp_generic_recvmsg
sctp_generic_sendmsg
sctp_generic_sendmsg_iov
sctp_peeloff

##
## Allow pselect(2) and select(2), which will be scoped by capability rights.
##
## XXXRW: But is it?
##
pselect
select

##
## Allow I/O-related file descriptors, subject to capability rights.  Use of
## explicit addresses here is restricted by the system calls themselves.
##
send
sendfile
sendmsg
sendto

##
## Allow setting per-process audit state, which is controlled separately by
## privileges.
##
setaudit
setaudit_addr
setauid

##
## Allow setting thread context.
##
setcontext

##
## Allow setting current process credential state, which is controlled
## separately by privilege.
##
setegid
seteuid
setgid

##
## Allow use of the process interval timer.
##
setitimer

##
## Allow setpriority(2).
##
## XXXRW: Requires scoping.
##
setpriority

##
## Allow setting current process credential state, which is controlled
## separately by privilege.
##
setregid
setresgid
setresuid
setreuid

##
## Allow setting process resource limits with setrlimit(2).
##
setrlimit

##
## Allow creating a new session with setsid(2).
##
setsid

##
## Allow setting socket options with setsockopt(2), subject to capability
## rights.
##
## XXXRW: Might require scoping.
##
setsockopt

##
## Allow setting current process credential state, which is controlled
## separately by privilege.
##
setuid

##
## shm_open(2) is scoped so as to allow only access to new anonymous objects.
##
shm_open
shm_open2

##
## Allow I/O-related file descriptors, subject to capability rights.
##
shutdown

##
## Allow signal control on current process.
##
sigaction
sigaltstack
sigblock
sigfastblock
sigpending
sigprocmask
sigqueue
sigreturn
sigsetmask
sigstack
sigsuspend
sigtimedwait
sigvec
sigwaitinfo
sigwait

##
## Allow creating new socket pairs with socket(2) and socketpair(2).
##
socket
socketpair

##
## Allow simple VM operations on the current process.
##
## XXXRW: Kernel doesn't implement this, so drop?
##
sstk

##
## Do allow sync(2) for now, but possibly shouldn't.
##
sync

##
## Always allow process termination with sys_exit(2).
##
sys_exit

##
## sysarch(2) does rather diverse things, but is required on at least i386
## in order to configure per-thread data.  As such, it's scoped on each
## architecture.
##
sysarch

##
## Allow thread operations operating only on current process.
##
thr_create
thr_exit
thr_kill

##
## Disallow thr_kill2(2), as it may operate beyond the current process.
##
## XXXRW: Requires scoping.
##
#thr_kill2

##
## Allow thread operations operating only on current process.
##
thr_new
thr_self
thr_set_name
thr_suspend
thr_wake

##
## Allow manipulation of the current process umask with umask(2).
##
umask

##
## Allow submitting of process trace entries with utrace(2).
##
utrace

##
## Allow generating UUIDs with uuidgen(2).
##
uuidgen

##
## Allow I/O-related file descriptors, subject to capability rights.
##
write
writev

##
## Allow processes to yield(2).
##
yield