Manual Pages  — CAP_SYSCTL

cap_sysctlbyname – library for getting or setting system information in capability mode

LIBRARY SYNOPSIS DESCRIPTION LIMITS EXAMPLES SEE ALSO HISTORY AUTHORS

libcap_sysctl

#include <sys/nv.h>

#include <libcasper.h>

#include <casper/cap_sysctl.h>

int
cap_sysctlbyname(cap_channel_t *chan, const char *name, void *oldp, size_t *oldlenp, const void *newp, size_t newlen);

The following example first opens a capability to casper and then uses this capability to create the system.sysctl casper service and uses it to get the value of kern.trap_enotcap.

cap_channel_t *capcas, *capsysctl;
const char *name = "kern.trap_enotcap";
nvlist_t *limits;
int value;
size_t size;

/* Open capability to Casper. */
capcas = cap_init();
if (capcas == NULL)
        err(1, "Unable to contact Casper");

/* Enter capability mode sandbox. */
if (cap_enter() < 0 && errno != ENOSYS)
        err(1, "Unable to enter capability mode");

/* Use Casper capability to create capability to the system.sysctl service. */
capsysctl = cap_service_open(capcas, "system.sysctl");
if (capsysctl == NULL)
        err(1, "Unable to open system.sysctl service");

/* Close Casper capability, we don't need it anymore. */
cap_close(capcas);

/* Create limit for one MIB with read access only. */
limits = nvlist_create(0);
nvlist_add_number(limits, name, CAP_SYSCTL_READ);

/* Limit system.sysctl. */
if (cap_limit_set(capsysctl, limits) < 0)
        err(1, "Unable to set limits");

/* Fetch value. */
if (cap_sysctlbyname(capsysctl, name, &value, &size, NULL, 0) < 0)
        err(1, "Unable to get value of sysctl");

printf("The value of %s is %d. , name, value);

cap_close(capsysctl);

The cap_sysctl service first appeared in FreeBSD 10.3 .

The cap_sysctl service was implemented by Pawel Jakub Dawidek <Mt pawel@dawidek.net> under sponsorship from the FreeBSD Foundation.

This manual page was written by Mariusz Zaborski <Mt oshogbo@FreeBSD.org>.