Manual Pages  — CAP_GRP

cap_getgrent, cap_getgrnam, cap_getgrgid, cap_getgrent_r, cap_getgrnam_r, cap_getgrgid_r, cap_setgroupent, cap_setgrent, cap_endgrent, cap_grp_limit_cmds, cap_grp_limit_fields, cap_grp_limit_groups – library for group database operations in capability mode

LIBRARY SYNOPSIS DESCRIPTION EXAMPLES SEE ALSO HISTORY AUTHORS

libcap_grp

#include <sys/nv.h>

#include <libcasper.h>

#include <casper/cap_grp.h>

struct group *
cap_getgrent(cap_channel_t *chan);

struct group *
cap_getgrnam(cap_channel_t *chan, const char *name);

struct group *
cap_getgrgid(cap_channel_t *chan, gid_t gid);

int
cap_getgrent_r(cap_channel_t *chan, struct group *grp, char *buffer, size_t bufsize, struct group **result);

int
cap_getgrnam_r(cap_channel_t *chan, const char *name, struct group *grp, char *buffer, size_t bufsize, struct group **result);

int
cap_getgrgid_r(cap_channel_t *chan, gid_t gid, struct group *grp, char *buffer, size_t bufsize, struct group **result);

int
cap_setgroupent(cap_channel_t *chan, int stayopen);

.Ft int
cap_setgrent(cap_channel_t *chan);

void
cap_endgrent(cap_channel_t *chan);

int
cap_grp_limit_cmds(cap_channel_t *chan, const char * const *cmds, size_t ncmds);

int
cap_grp_limit_fields(cap_channel_t *chan, const char * const *fields, size_t nfields);

int
cap_grp_limit_groups(cap_channel_t *chan, const char * const *names, size_t nnames, const gid_t *gids, size_t ngids);

The following example first opens a capability to casper and then uses this capability to create the system.grp casper service and uses it to get a group name.

cap_channel_t *capcas, *capgrp;
const char *cmds[] = { "getgrgid" };
const char *fields[] = { "gr_name" };
const gid_t gid[] = { 1 };
struct group *group;

/* Open capability to Casper. */
capcas = cap_init();
if (capcas == NULL)
        err(1, "Unable to contact Casper");

/* Enter capability mode sandbox. */
if (cap_enter() < 0 && errno != ENOSYS)
        err(1, "Unable to enter capability mode");

/* Use Casper capability to create capability to the system.grp service. */
capgrp = cap_service_open(capcas, "system.grp");
if (capgrp == NULL)
        err(1, "Unable to open system.grp service");

/* Close Casper capability, we don't need it anymore. */
cap_close(capcas);

/* Limit service to one single function. */
if (cap_grp_limit_cmds(capgrp, cmds, nitems(cmds)))
        err(1, "Unable to limit access to system.grp service");

/* Limit service to one field as we only need name of the group. */
if (cap_grp_limit_fields(capgrp, fields, nitems(fields)))
        err(1, "Unable to limit access to system.grp service");

/* Limit service to one gid. */
if (cap_grp_limit_groups(capgrp, NULL, 0, gid, nitems(gid)))
        err(1, "Unable to limit access to system.grp service");

group = cap_getgrgid(capgrp, gid[0]);
if (group == NULL)
        err(1, "Unable to get name of group");

printf("GID %d is associated with name %s. , gid[0], group->gr_name);

cap_close(capgrp);

The cap_grp service first appeared in FreeBSD 10.3 .

The cap_grp service was implemented by Pawel Jakub Dawidek <Mt pawel@dawidek.net> under sponsorship from the FreeBSD Foundation.

This manual page was written by Mariusz Zaborski <Mt oshogbo@FreeBSD.org>.