1## 2## Copyright (c) 2008-2010 Robert N. M. Watson 3## All rights reserved. 4## 5## This software was developed at the University of Cambridge Computer 6## Laboratory with support from a grant from Google, Inc. 7## 8## Redistribution and use in source and binary forms, with or without 9## modification, are permitted provided that the following conditions 10## are met: 11## 1. Redistributions of source code must retain the above copyright 12## notice, this list of conditions and the following disclaimer. 13## 2. Redistributions in binary form must reproduce the above copyright 14## notice, this list of conditions and the following disclaimer in the 15## documentation and/or other materials provided with the distribution. 16## 17## THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18## ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19## IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20## ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21## FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22## DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23## OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24## HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25## LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26## OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27## SUCH DAMAGE. 28## 29## List of system calls enabled in capability mode, one name per line. 30## 31## Notes: 32## - sys_exit(2), abort2(2) and close(2) are very important. 33## - Sorted alphabetically, please keep it that way. 34## 35## $FreeBSD$ 36## 37 38## 39## Allow ACL and MAC label operations by file descriptor, subject to 40## capability rights. Allow MAC label operations on the current process but 41## we will need to scope __mac_get_pid(2). 42## 43__acl_aclcheck_fd 44__acl_delete_fd 45__acl_get_fd 46__acl_set_fd 47__mac_get_fd 48#__mac_get_pid 49__mac_get_proc 50__mac_set_fd 51__mac_set_proc 52 53## 54## Allow sysctl(2) as we scope internal to the call; this is a global 55## namespace, but there are several critical sysctls required for almost 56## anything to run, such as hw.pagesize. For now that policy lives in the 57## kernel for performance and simplicity, but perhaps it could move to a 58## proxying daemon in userspace. 59## 60__sysctl 61 62## 63## Allow umtx operations as these are scoped by address space. 64## 65## XXRW: Need to check this very carefully. 66## 67_umtx_op 68 69## 70## Allow process termination using abort2(2). 71## 72abort2 73 74## 75## Allow accept(2) since it doesn't manipulate namespaces directly, rather 76## relies on existing bindings on a socket, subject to capability rights. 77## 78accept 79accept4 80 81## 82## Allow AIO operations by file descriptor, subject to capability rights. 83## 84aio_cancel 85aio_error 86aio_fsync 87aio_read 88aio_return 89aio_suspend 90aio_waitcomplete 91aio_write 92 93## 94## audit(2) is a global operation, submitting to the global trail, but it is 95## controlled by privilege, and it might be useful to be able to submit 96## records from sandboxes. For now, disallow, but we may want to think about 97## providing some sort of proxy service for this. 98## 99#audit 100 101## 102## Allow bindat(2). 103## 104bindat 105 106## 107## Allow capability mode and capability system calls. 108## 109cap_enter 110cap_fcntls_get 111cap_fcntls_limit 112cap_getmode 113cap_ioctls_get 114cap_ioctls_limit 115__cap_rights_get 116cap_rights_limit 117 118## 119## Allow read-only clock operations. 120## 121clock_getres 122clock_gettime 123 124## 125## Always allow file descriptor close(2). 126## 127close 128closefrom 129 130## 131## Allow connectat(2). 132## 133connectat 134 135## 136## cpuset(2) and related calls are limited to caller's own process/thread. 137## 138#cpuset 139cpuset_getaffinity 140#cpuset_getid 141cpuset_setaffinity 142#cpuset_setid 143 144## 145## Always allow dup(2) and dup2(2) manipulation of the file descriptor table. 146## 147dup 148dup2 149 150## 151## Allow extended attribute operations by file descriptor, subject to 152## capability rights. 153## 154extattr_delete_fd 155extattr_get_fd 156extattr_list_fd 157extattr_set_fd 158 159## 160## Allow changing file flags, mode, and owner by file descriptor, subject to 161## capability rights. 162## 163fchflags 164fchmod 165fchown 166 167## 168## For now, allow fcntl(2), subject to capability rights, but this probably 169## needs additional scoping. 170## 171fcntl 172 173## 174## Allow fexecve(2), subject to capability rights. We perform some scoping, 175## such as disallowing privilege escalation. 176## 177fexecve 178 179## 180## Allow flock(2), subject to capability rights. 181## 182flock 183 184## 185## Allow fork(2), even though it returns pids -- some applications seem to 186## prefer this interface. 187## 188fork 189 190## 191## Allow fpathconf(2), subject to capability rights. 192## 193fpathconf 194 195## 196## Allow various file descriptor-based I/O operations, subject to capability 197## rights. 198## 199freebsd11_fstat 200freebsd11_fstatat 201freebsd11_getdirentries 202freebsd11_fstatfs 203freebsd11_mknodat 204freebsd6_ftruncate 205freebsd6_lseek 206freebsd6_mmap 207freebsd6_pread 208freebsd6_pwrite 209 210## 211## Allow querying file and file system state with fstat(2) and fstatfs(2), 212## subject to capability rights. 213## 214fstat 215fstatfs 216 217## 218## Allow further file descriptor-based I/O operations, subject to capability 219## rights. 220## 221fsync 222ftruncate 223 224## 225## Allow futimens(2) and futimes(2), subject to capability rights. 226## 227futimens 228futimes 229 230## 231## Allow querying process audit state, subject to normal access control. 232## 233getaudit 234getaudit_addr 235getauid 236 237## 238## Allow thread context management with getcontext(2). 239## 240getcontext 241 242## 243## Allow directory I/O on a file descriptor, subject to capability rights. 244## Originally we had separate capabilities for directory-specific read 245## operations, but on BSD we allow reading the raw directory data, so we just 246## rely on CAP_READ now. 247## 248getdents 249getdirentries 250 251## 252## Allow querying certain trivial global state. 253## 254getdomainname 255 256## 257## Allow querying certain per-process resource limit state. 258## 259getdtablesize 260 261## 262## Allow querying current process credential state. 263## 264getegid 265geteuid 266 267## 268## Allow querying certain trivial global state. 269## 270gethostid 271gethostname 272 273## 274## Allow querying per-process timer. 275## 276getitimer 277 278## 279## Allow querying current process credential state. 280## 281getgid 282getgroups 283getlogin 284 285## 286## Allow querying certain trivial global state. 287## 288getpagesize 289getpeername 290 291## 292## Allow querying certain per-process scheduling, resource limit, and 293## credential state. 294## 295## XXXRW: getpgid(2) needs scoping. It's not clear if it's worth scoping 296## getppid(2). getpriority(2) needs scoping. getrusage(2) needs scoping. 297## getsid(2) needs scoping. 298## 299getpgid 300getpgrp 301getpid 302getppid 303getpriority 304getresgid 305getresuid 306getrlimit 307getrusage 308getsid 309 310## 311## Allow getrandom 312## 313getrandom 314 315## 316## Allow querying socket state, subject to capability rights. 317## 318## XXXRW: getsockopt(2) may need more attention. 319## 320getsockname 321getsockopt 322 323## 324## Allow querying the global clock. 325## 326gettimeofday 327 328## 329## Allow querying current process credential state. 330## 331getuid 332 333## 334## Allow ioctl(2), which hopefully will be limited by applications only to 335## required commands with cap_ioctls_limit(2) syscall. 336## 337ioctl 338 339## 340## Allow querying current process credential state. 341## 342issetugid 343 344## 345## Allow kevent(2), as we will authorize based on capability rights on the 346## target descriptor. 347## 348kevent 349 350## 351## Allow kill(2), as we allow the process to send signals only to himself. 352## 353kill 354 355## 356## Allow message queue operations on file descriptors, subject to capability 357## rights. 358## NOTE: Corresponding sysents are initialized in sys/kern/uipc_mqueue.c with 359## SYF_CAPENABLED. 360## 361kmq_notify 362kmq_setattr 363kmq_timedreceive 364kmq_timedsend 365 366## 367## Allow kqueue(2), we will control use. 368## 369kqueue 370 371## 372## Allow managing per-process timers. 373## 374ktimer_create 375ktimer_delete 376ktimer_getoverrun 377ktimer_gettime 378ktimer_settime 379 380## 381## We can't allow ktrace(2) because it relies on a global namespace, but we 382## might want to introduce an fktrace(2) of some sort. 383## 384#ktrace 385 386## 387## Allow AIO operations by file descriptor, subject to capability rights. 388## 389lio_listio 390 391## 392## Allow listen(2), subject to capability rights. 393## 394## XXXRW: One might argue this manipulates a global namespace. 395## 396listen 397 398## 399## Allow I/O-related file descriptors, subject to capability rights. 400## 401lseek 402 403## 404## Allow simple VM operations on the current process. 405## 406madvise 407mincore 408minherit 409mlock 410mlockall 411 412## 413## Allow memory mapping a file descriptor, and updating protections, subject 414## to capability rights. 415## 416mmap 417mprotect 418 419## 420## Allow simple VM operations on the current process. 421## 422msync 423munlock 424munlockall 425munmap 426 427## 428## Allow the current process to sleep. 429## 430nanosleep 431 432## 433## Allow querying the global clock. 434## 435ntp_gettime 436 437## 438## Allow AIO operations by file descriptor, subject to capability rights. 439## 440oaio_read 441oaio_write 442 443## 444## Allow simple VM operations on the current process. 445## 446break 447 448## 449## Allow AIO operations by file descriptor, subject to capability rights. 450## 451olio_listio 452 453## 454## Operations relative to directory capabilities. 455## 456chflagsat 457faccessat 458fchmodat 459fchownat 460fstatat 461futimesat 462linkat 463mkdirat 464mkfifoat 465mknodat 466openat 467readlinkat 468renameat 469symlinkat 470unlinkat 471utimensat 472 473## 474## Process descriptor-related system calls are allowed. 475## 476pdfork 477pdgetpid 478pdkill 479#pdwait4 # not yet implemented 480 481## 482## Allow pipe(2). 483## 484pipe 485pipe2 486 487## 488## Allow poll(2), which will be scoped by capability rights. 489## 490poll 491ppoll 492 493## 494## Allow I/O-related file descriptors, subject to capability rights. 495## 496posix_fallocate 497pread 498preadv 499 500## 501## Allow access to profiling state on the current process. 502## 503profil 504 505## 506## Disallow ptrace(2) for now, but we do need debugging facilities in 507## capability mode, so we will want to revisit this, possibly by scoping its 508## operation. 509## 510#ptrace 511 512## 513## Allow I/O-related file descriptors, subject to capability rights. 514## 515pwrite 516pwritev 517read 518readv 519recv 520recvfrom 521recvmsg 522 523## 524## Allow real-time scheduling primitives to be used. 525## 526## XXXRW: These require scoping. 527## 528rtprio 529rtprio_thread 530 531## 532## Allow simple VM operations on the current process. 533## 534sbrk 535 536## 537## Allow querying trivial global scheduler state. 538## 539sched_get_priority_max 540sched_get_priority_min 541 542## 543## Allow various thread/process scheduler operations. 544## 545## XXXRW: Some of these require further scoping. 546## 547sched_getparam 548sched_getscheduler 549sched_rr_get_interval 550sched_setparam 551sched_setscheduler 552sched_yield 553 554## 555## Allow I/O-related file descriptors, subject to capability rights. 556## NOTE: Corresponding sysents are initialized in sys/netinet/sctp_syscalls.c 557## with SYF_CAPENABLED. 558## 559sctp_generic_recvmsg 560sctp_generic_sendmsg 561sctp_generic_sendmsg_iov 562sctp_peeloff 563 564## 565## Allow pselect(2) and select(2), which will be scoped by capability rights. 566## 567## XXXRW: But is it? 568## 569pselect 570select 571 572## 573## Allow I/O-related file descriptors, subject to capability rights. Use of 574## explicit addresses here is restricted by the system calls themselves. 575## 576send 577sendfile 578sendmsg 579sendto 580 581## 582## Allow setting per-process audit state, which is controlled separately by 583## privileges. 584## 585setaudit 586setaudit_addr 587setauid 588 589## 590## Allow setting thread context. 591## 592setcontext 593 594## 595## Allow setting current process credential state, which is controlled 596## separately by privilege. 597## 598setegid 599seteuid 600setgid 601 602## 603## Allow use of the process interval timer. 604## 605setitimer 606 607## 608## Allow setpriority(2). 609## 610## XXXRW: Requires scoping. 611## 612setpriority 613 614## 615## Allow setting current process credential state, which is controlled 616## separately by privilege. 617## 618setregid 619setresgid 620setresuid 621setreuid 622 623## 624## Allow setting process resource limits with setrlimit(2). 625## 626setrlimit 627 628## 629## Allow creating a new session with setsid(2). 630## 631setsid 632 633## 634## Allow setting socket options with setsockopt(2), subject to capability 635## rights. 636## 637## XXXRW: Might require scoping. 638## 639setsockopt 640 641## 642## Allow setting current process credential state, which is controlled 643## separately by privilege. 644## 645setuid 646 647## 648## shm_open(2) is scoped so as to allow only access to new anonymous objects. 649## 650shm_open 651 652## 653## Allow I/O-related file descriptors, subject to capability rights. 654## 655shutdown 656 657## 658## Allow signal control on current process. 659## 660sigaction 661sigaltstack 662sigblock 663sigpending 664sigprocmask 665sigqueue 666sigreturn 667sigsetmask 668sigstack 669sigsuspend 670sigtimedwait 671sigvec 672sigwaitinfo 673sigwait 674 675## 676## Allow creating new socket pairs with socket(2) and socketpair(2). 677## 678socket 679socketpair 680 681## 682## Allow simple VM operations on the current process. 683## 684## XXXRW: Kernel doesn't implement this, so drop? 685## 686sstk 687 688## 689## Do allow sync(2) for now, but possibly shouldn't. 690## 691sync 692 693## 694## Always allow process termination with sys_exit(2). 695## 696sys_exit 697 698## 699## sysarch(2) does rather diverse things, but is required on at least i386 700## in order to configure per-thread data. As such, it's scoped on each 701## architecture. 702## 703sysarch 704 705## 706## Allow thread operations operating only on current process. 707## 708thr_create 709thr_exit 710thr_kill 711 712## 713## Disallow thr_kill2(2), as it may operate beyond the current process. 714## 715## XXXRW: Requires scoping. 716## 717#thr_kill2 718 719## 720## Allow thread operations operating only on current process. 721## 722thr_new 723thr_self 724thr_set_name 725thr_suspend 726thr_wake 727 728## 729## Allow manipulation of the current process umask with umask(2). 730## 731umask 732 733## 734## Allow submitting of process trace entries with utrace(2). 735## 736utrace 737 738## 739## Allow generating UUIDs with uuidgen(2). 740## 741uuidgen 742 743## 744## Allow I/O-related file descriptors, subject to capability rights. 745## 746write 747writev 748 749## 750## Allow processes to yield(2). 751## 752yield 753