PERFORCE change 134007 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=134007

Change 134007 by rwatson at rwatson_freebsd_capabilities on 2008/01/24 13:34:21

	Add ENOTCAPABLE and return this instead of EACCES when a
	capability rights check fails.  This makes capability failure
	modes distinct from access control failures on the underlying
	object, but avoids using EBADF (used for FREAD/FWRITE failure
	in POSIX) that makes it tricky to debug bad file descriptors
	(which occur more frequently when debugging capability system
	programs).

Affected files ...

.. //depot/projects/trustedbsd/capabilities/src/sys/kern/sys_capability.c#8 edit
.. //depot/projects/trustedbsd/capabilities/src/sys/sys/errno.h#2 edit

Differences ...

==== //depot/projects/trustedbsd/capabilities/src/sys/kern/sys_capability.c#8 (text+ko) ====

@@ -64,7 +64,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/sys_capability.c#7 $");
+__FBSDID("$P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/sys_capability.c#8 $");
 
 #include <sys/param.h>
 #include <sys/capability.h>
@@ -138,7 +138,7 @@
 {
 
 	if ((c->cap_rights | rights) != c->cap_rights)
-		return (EACCES);
+		return (ENOTCAPABLE);
 	return (0);
 }
 

==== //depot/projects/trustedbsd/capabilities/src/sys/sys/errno.h#2 (text+ko) ====

@@ -174,7 +174,11 @@
 #define	EPROTO		92		/* Protocol error */
 
 #ifndef _POSIX_SOURCE
-#define	ELAST		92		/* Must be equal largest errno */
+#define	ENOTCAPABLE	93		/* Capabilities insufficient */
+#endif /* _POSIX_SOURCE */
+
+#ifndef _POSIX_SOURCE
+#define	ELAST		93		/* Must be equal largest errno */
 #endif /* _POSIX_SOURCE */
 
 #ifdef _KERNEL