Module: BSD::Capsicum
- Extended by:
- Capsicum
- Included in:
- Capsicum
- Defined in:
- lib/bsd/capsicum.rb,
lib/bsd/capsicum/ffi.rb,
lib/bsd/capsicum/version.rb,
lib/bsd/capsicum/constants.rb
Defined Under Namespace
Constant Summary collapse
- VERSION =
"0.4.1"
Instance Method Summary collapse
-
#in_capability_mode? ⇒ Boolean
(also: #capability_mode?)
Check if we’re in capability mode.
-
#enter! ⇒ Boolean
(also: #enter_capability_mode!, #enter_cap_mode!)
Enter a process into capability mode.
-
#permit!(io, *caps, scope: :rights) ⇒ Boolean
Limit the capabilities of a file descriptor.
Instance Method Details
#in_capability_mode? ⇒ Boolean Also known as: capability_mode?
Check if we’re in capability mode
20 21 22 23 24 25 26 27 28 29 |
# File 'lib/bsd/capsicum.rb', line 20 def in_capability_mode? uintp = Fiddle::Pointer.malloc(Fiddle::SIZEOF_UINT) if FFI.cap_getmode(uintp).zero? uintp[0, Fiddle::SIZEOF_UINT].unpack("i") == [1] else raise SystemCallError.new("cap_getmode", Fiddle.last_error) end ensure uintp.call_free end |
#enter! ⇒ Boolean Also known as: enter_capability_mode!, enter_cap_mode!
Enter a process into capability mode
39 40 41 42 |
# File 'lib/bsd/capsicum.rb', line 39 def enter! FFI.cap_enter.zero? || raise(SystemCallError.new("cap_enter", Fiddle.last_error)) end |
#permit!(io, *caps, scope: :rights) ⇒ Boolean
Limit the capabilities of a file descriptor
65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 |
# File 'lib/bsd/capsicum.rb', line 65 def permit!(io, *caps, scope: :rights) if scope == :fcntl FFI.cap_fcntls_limit(io.to_i, caps).zero? || raise(SystemCallError.new("cap_fcntls_limit", Fiddle.last_error)) elsif scope == :rights rightsp = Fiddle::Pointer.malloc(Constants::SIZEOF_CAP_RIGHTS_T) FFI.cap_rights_init(rightsp, *caps) FFI.cap_rights_limit(io.to_i, rightsp).zero? || raise(SystemCallError.new("cap_rights_limit", Fiddle.last_error)) else raise ArgumentError, "invalid scope: #{scope}" end ensure rightsp&.call_free end |