Main index | Section 2 | Options |
#include <sys/capsicum.h>
When combined with cap_rights_limit(2), cap_ioctls_limit(2), cap_fcntls_limit(2), cap_enter() may be used to create kernel-enforced sandboxes in which appropriately-crafted applications or application components may be run.
cap_getmode() returns a flag indicating whether or not the process is in a capability mode sandbox.
See also the PROC_TRAPCAP_CTL and PROC_TRAPCAP_STATUS operations of the procctl(2) function for similar per-process functionality.
When the process is in capability mode, cap_getmode() sets the flag to a non-zero value. A zero value means the process is not in capability mode.
[ENOSYS] | |
The kernel is compiled without:
options CAPABILITY_MODE | |
The cap_getmode() system call may also return the following error:
[EFAULT] | |
Pointer modep points outside the process's allocated address space. | |
CAP_ENTER (2) | May 5, 2020 |
Main index | Section 2 | Options |
Please direct any comments about this manual page service to Ben Bullock. Privacy policy.
“ | Some people, when confronted with a problem, think “I know, I'll use regular expressions.” Now they have two problems. | ” |
— Jamie Zawinski |