CAP_SYSLOG(3)

okay bestie, welcome to CAP_SYSLOG(3) — a Library Functions Manual page, and it's fully about logging with syslog in capability mode. main character security energy, no cap. 💅✨

---

🎀 NAME 🎀

Meet the squad: cap_syslog, cap_vsyslog, cap_openlog, cap_closelog, cap_setlogmask — the library for syslog in capability mode. they're here to help you log safely, and honestly? iconic. 🫶

🌈 LIBRARY 🌈

This one lives in “libcap_syslog” — yes bestie, that's the library. 📚

✨ SYNOPSIS ✨

okay, here's the include-and-prototype moment. copy these exactly, i'm not kidding:

#include <libcasper.h>
#include <casper/cap_syslog.h>

void
cap_syslog(cap_channel_t *chan, int pri, const char *fmt, ...);

void
cap_vsyslog(cap_channel_t *chan, int priority, const char *fmt,
    va_list ap);

void
cap_openlog(cap_channel_t *chan, const char *ident, int logopt,
    int facility);

void
cap_closelog(cap_channel_t *chan);

int
cap_setlogmask(cap_channel_t *chan, int maskpri);

💅 DESCRIPTION 💅

So cap_syslog(), cap_vsyslog(), cap_openlog(), cap_closelog(), and cap_setlogmask() are literally the capability-mode besties of the classic syslog crew — respectively:

• cap_syslog() is equivalent to syslog(3)
• cap_vsyslog() is equivalent to vsyslog(3)
• cap_openlog() is equivalent to openlog(3)
• cap_closelog() is equivalent to closelog(3)
• cap_setlogmask() is equivalent to setlogmask(3)

with one big caveat: the connection to the system.syslog service needs to be provided. that's the whole point, iykyk. 🔥

All of these functions are reentrant but not thread-safe. translation: you may call them from separate threads only with different cap_channel_t arguments, or with synchronization. don't play yourself. 💀

🧚 EXAMPLES 🧚

The following example first opens a capability to casper and then uses this capability to create the system.syslog casper service to log messages. it's giving secure-logging tutorial, watch:

cap_channel_t *capcas, *capsyslog;

/* Open capability to Casper. */
capcas = cap_init();
if (capcas == NULL)
        err(1, "Unable to contact Casper");

/* Enter capability mode sandbox. */
if (cap_enter() < 0 && errno != ENOSYS)
        err(1, "Unable to enter capability mode");

/* Use Casper capability to create capability to the system.syslog service. */
capsyslog = cap_service_open(capcas, "system.syslog");
if (capsyslog == NULL)
        err(1, "Unable to open system.syslog service");

/* Close Casper capability, we don't need it anymore. */
cap_close(capcas);

/* Let's log something. */
cap_syslog(capsyslog, LOG_NOTICE, "System logs from capability mode.");

👑 SEE ALSO 👑

go give these pages some love: cap_enter(2), closelog(3), err(3), openlog(3), setlogmask(3), syslog(3), vsyslog(3), capsicum(4), nv(9). bestie behavior. 👑

🦋 HISTORY 🦋

The cap_syslog service first appeared in FreeBSD 10.3. periodt. 🦋

🌸 AUTHORS 🌸

Mariusz Zaborski — <oshogbo@FreeBSD.org> — author icon. 🌸

---

this page comes from Debian, dated December 6, 2023, and the manual name is CAP_SYSLOG(3) — mwah, bye bestie! 💅🎀