CAP_FCNTLS_LIMIT(2)

💅 cap_fcntls_limit, cap_fcntls_get — the system call manual page, bestie edition

okay so you found the CAP_FCNTLS_LIMIT(2) page, from the System Calls Manual ✨ — welcome, sit down, let's talk about managing allowed fcntl commands 🎀

---

🌸 NAME 🌸

cap_fcntls_limit, cap_fcntls_get — manage allowed fcntl commands 🦋

📚 LIBRARY 📚

Standard C Library (libc, -lc) 💖

✨ SYNOPSIS ✨

#include <sys/capsicum.h>

int
cap_fcntls_limit(int fd, uint32_t fcntlrights);

int
cap_fcntls_get(int fd, uint32_t *fcntlrightsp);

💫 DESCRIPTION 💫

So here's the tea, bestie 🫖 — if a file descriptor has been granted the CAP_FCNTL capability right, you can selectively reduce the list of allowed fcntl(2) commands using the cap_fcntls_limit() system call. Reduce only though!! You can never expand it back. That's the whole point, no cap 💀

And if you just wanna look at which fcntl commands a given file descriptor is allowed to run? That's cap_fcntls_get(), which hands you back a bitmask of allowed fcntl commands 👑

🚩 FLAGS 🚩

These are the flags you can pop into the fcntlrights argument, or that come back out in the fcntlrightsp argument:

• CAP_FCNTL_GETFL — lets the F_GETFL command through 💅
• CAP_FCNTL_SETFL — lets the F_SETFL command through 💅
• CAP_FCNTL_GETOWN — lets the F_GETOWN command through 💅
• CAP_FCNTL_SETOWN — lets the F_SETOWN command through 💅

🫶 RETURN VALUES 🫶

If everything goes slay, the value 0 is returned 🌈 Otherwise you get the value -1 back, and the global variable errno gets set so it can tell you what went wrong 😭

💀 ERRORS 💀

cap_fcntls_limit() succeeds unless one of these happens:

• [EBADF] — the fd argument is not a valid descriptor 🙈
• [EINVAL] — an invalid flag got passed in fcntlrights 😬
• [ENOTCAPABLE] — fcntlrights would expand the list of allowed fcntl(2) commands 🚫 (not allowed, bestie, that door only swings one way)

cap_fcntls_get() succeeds unless one of these happens:

• [EBADF] — the fd argument is not a valid descriptor 🙈
• [EFAULT] — the fcntlrightsp argument points at an invalid address 💥
• [ENOSYS] — the running kernel was compiled without options CAPABILITY_MODE 😭

👀 SEE ALSO 👀

cap_ioctls_limit(2), cap_rights_limit(2), fcntl(2) — go read these next, iykyk 💜

🕰️ HISTORY 🕰️

The cap_fcntls_get() and cap_fcntls_limit() system calls first appeared in FreeBSD 8.3 ⭐ And support for capabilities and capabilities mode was developed as part of the TrustedBSD Project 🧚

👑 AUTHORS 👑

This function was created by Pawel Jakub Dawidek <pawel@dawidek.net> under sponsorship of the FreeBSD Foundation 💖

---

okay that's the whole page, main character energy from start to finish 🌸 this version came from Debian, dated March 9, 2023 — mwah, go forth and cap your fcntls responsibly 💅✨