From c24341d2e3f265ca594b82d3a43df2bc41921105 Mon Sep 17 00:00:00 2001 From: Ed Schouten Date: Wed, 14 Jan 2015 13:03:03 +0000 Subject: [PATCH] Make sure CAP_BINDAT and CAP_CONNECTAT are part of CAP_ALL0. This makes sure that file descriptors of opened directories will actually get these capabilities. Without this change, bindat() and connectat() don't seem to work for me. MFC after: 2 weeks Reviewed by: rwatson, pjd --- sys/sys/capsicum.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/sys/capsicum.h b/sys/sys/capsicum.h index 61888116094..de113c62fef 100644 --- a/sys/sys/capsicum.h +++ b/sys/sys/capsicum.h @@ -206,10 +206,10 @@ CAP_SETSOCKOPT | CAP_SHUTDOWN) /* All used bits for index 0. */ -#define CAP_ALL0 CAPRIGHT(0, 0x0000007FFFFFFFFFULL) +#define CAP_ALL0 CAPRIGHT(0, 0x000001FFFFFFFFFFULL) /* Available bits for index 0. */ -#define CAP_UNUSED0_40 CAPRIGHT(0, 0x0000008000000000ULL) +#define CAP_UNUSED0_42 CAPRIGHT(0, 0x0000020000000000ULL) /* ... */ #define CAP_UNUSED0_57 CAPRIGHT(0, 0x0100000000000000ULL)