sandbox: enable capabilities sandbox on FreeBSD

Makefile

@@ -5,6 +5,8 @@ ifeq ($(UNAME_SYS), Linux)
 	LDFLAGS += -luuid -lresolv -Wl,-Bsymbolic-functions -Wl,-z,relro
 	CFLAGS ?= -D_FORTIFY_SOURCE=2 -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -fno-strict-aliasing
 	XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= 0
+else ifeq ($(UNAME_SYS), FreeBSD)
+	XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_CAPSICUM
 else ifeq ($(UNAME_SYS), OpenBSD)
 	XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_PLEDGE
 else ifeq ($(UNAME_SYS), SunOS)

src/xmppipe_sandbox_capsicum.c

@@ -0,0 +1,71 @@
+/* Copyright (c) 2017, Michael Santos <michael.santos@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifdef XMPPIPE_SANDBOX_CAPSICUM
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <sys/capability.h>
+
+#include <errno.h>
+
+#include "xmppipe.h"
+
+    int
+xmppipe_sandbox_init(xmppipe_state_t *state)
+{
+    struct rlimit rl;
+    cap_rights_t policy_read;
+    cap_rights_t policy_write;
+    cap_rights_t policy_rw;
+
+    int fd = -1;
+
+    rl.rlim_cur = 0;
+    rl.rlim_max = 0;
+
+    if (setrlimit(RLIMIT_NPROC, &rl) < 0)
+        return -1;
+
+    fd = xmppipe_conn_fd(state);
+    if (fd < 0)
+        return -1;
+
+    rl.rlim_cur = fd;
+    rl.rlim_max = fd;
+
+    if (setrlimit(RLIMIT_NOFILE, &rl) < 0)
+        return -1;
+
+    cap_rights_init(&policy_read, CAP_READ, CAP_EVENT);
+    cap_rights_init(&policy_write, CAP_WRITE);
+    cap_rights_init(&policy_rw, CAP_READ, CAP_WRITE,
+            CAP_FSTAT, CAP_FCNTL, CAP_EVENT);
+
+    if (cap_rights_limit(STDIN_FILENO, &policy_read) < 0)
+        return -1;
+
+    if (cap_rights_limit(STDOUT_FILENO, &policy_write) < 0)
+        return -1;
+
+    if (cap_rights_limit(STDERR_FILENO, &policy_write) < 0)
+        return -1;
+
+    if (cap_rights_limit(fd, &policy_rw) < 0)
+        return -1;
+
+    return cap_enter();
+}
+#endif