# An introduction to FreeBSD-Capsicum

DevFeed: [An introduction to FreeBSD-Capsicum](<https://devfeed.tech/articles/an-introduction-to-freebsd-capsicum-21556.md>)

Original publisher: [Read original article](<http://lackingrhoticity.blogspot.com/2010/11/introduction-to-freebsd-capsicum.html>)

Author: Mark Seaborn (noreply@blogger.com)

Published: 2010-11-04T12:48:00Z

Content type: article

Language: en

Sources: [Mark Seaborn](<https://devfeed.tech/sources/mark-seaborn.md>)

Topics: [Unix](<https://devfeed.tech/topics/unix.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [features](<https://devfeed.tech/tags/features.md>), [files](<https://devfeed.tech/tags/files.md>), [filesystem](<https://devfeed.tech/tags/filesystem.md>), [introduction](<https://devfeed.tech/tags/introduction.md>), [permission](<https://devfeed.tech/tags/permission.md>), [process](<https://devfeed.tech/tags/process.md>), [unix](<https://devfeed.tech/tags/unix.md>)

## AI overview

An overview of FreeBSD Capsicum, a capability-based security framework for sandboxing. It describes capability mode, restricted file-descriptor permissions, process descriptors, message-based sockets, and fexecve().

## Source excerpt

In my last blog post, I described one of the features in FreeBSD-Capsicum: process descriptors. Now it's time for an overview of Capsicum. Capsicum is a set of new features for FreeBSD that adds better support for sandboxing, using a capability model in which the capabilities are Unix file descriptors (FDs). Capsicum takes a fairly conservative approach, in that it does not make operations on file descriptors virtualisable. This approach has some limitations -- we do not get the advantages of having purely message-passing syscalls. However, it does mean that the new features are orthogonal. The main new features are: A per-process "capability mode", which is turned on via a new cap_enter() syscall. This mode disables any system call that provides ambient authority. So it disables system calls that use global namespaces, including the file namespace (e.g. open()), the PID namespace (e.g. kill()) and the network address namespace (e.g. connect()). This is not just a syscall filter, though. Some system calls optionally use a global namespace. For example, sendmsg() and sendto() optionally take a socket address. For openat(), the directory FD can be omitted. Capability mode disables those cases. Furthermore, capability mode disallows the use of ".." (parent directory) in filenames for openat() and the other *at() calls. This changes directory FDs to be limited-authority objects that convey access to a specific directory and not the whole filesystem. (It is interesting that this appears to be a property of the process, via capability mode, rather than of the directory FD itself.) Capability mode is inherited across fork and exec. Finer-grained permissions for file descriptors. Each FD gets a large set of permission bits. A less-permissive copy of an FD can be created with cap_new(). For example, you can have read-only directory FDs, or non-seekable FDs for files. Process descriptors. Capsicum doesn't allow kill() inside the sandbox because kill() uses a global namespace