The branch main has been updated by emaste:
URL:
https://cgit.FreeBSD.org/src/commit/?id=54eda43cc1e6b1d73804b6c397a15002e3519555
commit 54eda43cc1e6b1d73804b6c397a15002e3519555
Author: Ed Maste <ema...@freebsd.org>
AuthorDate: 2025-06-05 23:44:05 +0000
Commit: Ed Maste <ema...@freebsd.org>
CommitDate: 2025-06-17 19:41:05 +0000
beep: Capsicumize
While it's unlikely that beep(1) will be used in a context where a
sandbox is particularly valuable, it does offer a simple demonstration
of entering a capability sandbox after opening required fds, and is
trivial to do.
Reviewed by: christos
Event: Kitchener-Waterloo Hackathon 202506
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D50709
---
usr.bin/beep/beep.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/usr.bin/beep/beep.c b/usr.bin/beep/beep.c
index 0bdfe2cf97a7..9d274770ad75 100644
--- a/usr.bin/beep/beep.c
+++ b/usr.bin/beep/beep.c
@@ -25,6 +25,7 @@
#include <sys/soundcard.h>
+#include <capsicum_helpers.h>
#include <err.h>
#include <errno.h>
#include <fcntl.h>
@@ -204,6 +205,9 @@ main(int argc, char **argv)
if (f < 0)
err(1, "Failed to open '%s'", oss_dev);
+ if (caph_enter() == -1)
+ err(1, "Failed to enter capability mode");
+
c = 1; /* mono */
if (ioctl(f, SOUND_PCM_WRITE_CHANNELS, &c) != 0)
errx(1, "ioctl SOUND_PCM_WRITE_CHANNELS(1) failed");
