kern - Make lseek(2) generic

* Extend fileops with fo_seek function allowing pluggable lseek(2)
implementations. Part of preparation for linux DMA-BUF compat API.

* Move current vnode lseek imple

kern - Make lseek(2) generic

* Extend fileops with fo_seek function allowing pluggable lseek(2)
implementations. Part of preparation for linux DMA-BUF compat API.

* Move current vnode lseek implementation into vnode and devfs fileops.
Code is exactly the same in both, note about duplication added.

* Set remaining fileops to badfo_seek.

Mentored-By: dillon

show more ...

devfs - Fix root open() errors on /dev/[k]mem, /dev/[u]random

* devfs had a code bug related to QUICK flagged devices, which
are only the mmio devices, where open() failures were being
ignored.

devfs - Fix root open() errors on /dev/[k]mem, /dev/[u]random

* devfs had a code bug related to QUICK flagged devices, which
are only the mmio devices, where open() failures were being
ignored.

This only happens with RESTRICTEDROOT and in jails. Fix the
code path.

show more ...

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restricti

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restrictions
are inherited by sub-processes recursively. Once set, restrictions cannot
be removed.

Basic restrictions that mimic an unadorned jail can be enabled without
creating a jail, but generally speaking real security also requires
creating a chrooted filesystem topology, and a jail is still needed
to really segregate processes from each other. If you do so, however,
you can (for example) disable mount/umount and most global root-only
features.

* Add new system calls and a manual page for syscap_get(2) and syscap_set(2)

* Add sys/caps.h

* Add the "setcaps" userland utility and manual page.

* Remove priv.9 and the priv_check infrastructure, replacing it with
a newly designed caps infrastructure.

* The intention is to add path restriction lists and similar features to
improve jailess security in the near future, and to optimize the
priv_check code.

show more ...