Change the cap_rights_t type from uint64_t to a structure that we can extend

in the future in a backward compatible (API and ABI) way.

The cap_rights_t represents capability rights. We used to use one bit to
represent one right, but we are running out of spare bits. Currently the new
structure provides place for 114 rights (so 50 more than the previous
cap_rights_t), but it is possible to grow the structure to hold at least 285
rights, although we can make it even larger if 285 rights won't be enough.

The structure definition looks like this:

	struct cap_rights {
		uint64_t	cr_rights[CAP_RIGHTS_VERSION + 2];
	};

The initial CAP_RIGHTS_VERSION is 0.

The top two bits in the first element of the cr_rights[] array contain total
number of elements in the array - 2. This means if those two bits are equal to
0, we have 2 array elements.

The top two bits in all remaining array elements should be 0.
The next five bits in all array elements contain array index. Only one bit is
used and bit position in this five-bits range defines array index. This means
there can be at most five array elements in the future.

To define new right the CAPRIGHT() macro must be used. The macro takes two
arguments - an array index and a bit to set, eg.

	#define	CAP_PDKILL	CAPRIGHT(1, 0x0000000000000800ULL)

We still support aliases that combine few rights, but the rights have to belong
to the same array element, eg:

	#define	CAP_LOOKUP	CAPRIGHT(0, 0x0000000000000400ULL)
	#define	CAP_FCHMOD	CAPRIGHT(0, 0x0000000000002000ULL)

	#define	CAP_FCHMODAT	(CAP_FCHMOD | CAP_LOOKUP)

There is new API to manage the new cap_rights_t structure:

	cap_rights_t *cap_rights_init(cap_rights_t *rights, ...);
	void cap_rights_set(cap_rights_t *rights, ...);
	void cap_rights_clear(cap_rights_t *rights, ...);
	bool cap_rights_is_set(const cap_rights_t *rights, ...);

	bool cap_rights_is_valid(const cap_rights_t *rights);
	void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
	void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
	bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);

Capability rights to the cap_rights_init(), cap_rights_set(),
cap_rights_clear() and cap_rights_is_set() functions are provided by
separating them with commas, eg:

	cap_rights_t rights;

	cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT);

There is no need to terminate the list of rights, as those functions are
actually macros that take care of the termination, eg:

	#define	cap_rights_set(rights, ...)				\
		__cap_rights_set((rights), __VA_ARGS__, 0ULL)
	void __cap_rights_set(cap_rights_t *rights, ...);

Thanks to using one bit as an array index we can assert in those functions that
there are no two rights belonging to different array elements provided
together. For example this is illegal and will be detected, because CAP_LOOKUP
belongs to element 0 and CAP_PDKILL to element 1:

	cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL);

Providing several rights that belongs to the same array's element this way is
correct, but is not advised. It should only be used for aliases definition.

This commit also breaks compatibility with some existing Capsicum system calls,
but I see no other way to do that. This should be fine as Capsicum is still
experimental and this change is not going to 9.x.

Sponsored by:	The FreeBSD Foundation

1 files changed, 140 insertions, 107 deletions

diff --git a/sys/sys/capability.h b/sys/sys/capability.h
index ec63de7..e5b9ec7 100644
--- a/sys/sys/capability.h
+++ b/sys/sys/capability.h
@@ -42,9 +42,16 @@
 #include <sys/cdefs.h>
 #include <sys/param.h>
 
+#include <sys/caprights.h>
 #include <sys/file.h>
 #include <sys/fcntl.h>
 
+#ifndef _KERNEL
+#include <stdbool.h>
+#endif
+
+#define	CAPRIGHT(idx, bit)	((1ULL << (57 + (idx))) | (bit))
+
 /*
  * Possible rights on capabilities.
  *
@@ -59,29 +66,31 @@
  * involve reads or writes depending a great deal on context.
  */
 
-#define	CAP_NONE		0x0000000000000000ULL
+/* INDEX 0 */
 
 /*
  * General file I/O.
  */
 /* Allows for openat(O_RDONLY), read(2), readv(2). */
-#define	CAP_READ		0x0000000000000001ULL
+#define	CAP_READ		CAPRIGHT(0, 0x0000000000000001ULL)
 /* Allows for openat(O_WRONLY | O_APPEND), write(2), writev(2). */
-#define	CAP_WRITE		0x0000000000000002ULL
+#define	CAP_WRITE		CAPRIGHT(0, 0x0000000000000002ULL)
+/* Allows for lseek(fd, 0, SEEK_CUR). */
+#define	CAP_SEEK_TELL		CAPRIGHT(0, 0x0000000000000004ULL)
 /* Allows for lseek(2). */
-#define	CAP_SEEK		0x0000000000000080ULL
+#define	CAP_SEEK		(CAP_SEEK_TELL | 0x0000000000000008ULL)
 /* Allows for pread(2), preadv(2). */
 #define	CAP_PREAD		(CAP_SEEK | CAP_READ)
 /* Allows for openat(O_WRONLY) (without O_APPEND), pwrite(2), pwritev(2). */
 #define	CAP_PWRITE		(CAP_SEEK | CAP_WRITE)
 /* Allows for mmap(PROT_NONE). */
-#define	CAP_MMAP		0x0000000000000004ULL
+#define	CAP_MMAP		CAPRIGHT(0, 0x0000000000000010ULL)
 /* Allows for mmap(PROT_READ). */
 #define	CAP_MMAP_R		(CAP_MMAP | CAP_SEEK | CAP_READ)
 /* Allows for mmap(PROT_WRITE). */
 #define	CAP_MMAP_W		(CAP_MMAP | CAP_SEEK | CAP_WRITE)
 /* Allows for mmap(PROT_EXEC). */
-#define	CAP_MMAP_X		(CAP_MMAP | CAP_SEEK | 0x0000000000000008ULL)
+#define	CAP_MMAP_X		(CAP_MMAP | CAP_SEEK | 0x0000000000000020ULL)
 /* Allows for mmap(PROT_READ | PROT_WRITE). */
 #define	CAP_MMAP_RW		(CAP_MMAP_R | CAP_MMAP_W)
 /* Allows for mmap(PROT_READ | PROT_EXEC). */
@@ -91,67 +100,67 @@
 /* Allows for mmap(PROT_READ | PROT_WRITE | PROT_EXEC). */
 #define	CAP_MMAP_RWX		(CAP_MMAP_R | CAP_MMAP_W | CAP_MMAP_X)
 /* Allows for openat(O_CREAT). */
-#define	CAP_CREATE		0x0000000000080000ULL
+#define	CAP_CREATE		CAPRIGHT(0, 0x0000000000000040ULL)
 /* Allows for openat(O_EXEC) and fexecve(2) in turn. */
-#define	CAP_FEXECVE		0x0000000000000010ULL
+#define	CAP_FEXECVE		CAPRIGHT(0, 0x0000000000000080ULL)
 /* Allows for openat(O_SYNC), openat(O_FSYNC), fsync(2). */
-#define	CAP_FSYNC		0x0000000000000020ULL
+#define	CAP_FSYNC		CAPRIGHT(0, 0x0000000000000100ULL)
 /* Allows for openat(O_TRUNC), ftruncate(2). */
-#define	CAP_FTRUNCATE		0x0000000000000040ULL
-
-/* VFS methods. */
-#define	CAP_FCHDIR		0x0000000000000200ULL
-#define	CAP_FCHFLAGS		0x0000000000000100ULL
-#define	CAP_CHFLAGSAT		CAP_FCHFLAGS
-#define	CAP_FCHMOD		0x0000000000000400ULL
-#define	CAP_FCHMODAT		CAP_FCHMOD
-#define	CAP_FCHOWN		0x0000000000000800ULL
-#define	CAP_FCHOWNAT		CAP_FCHOWN
-#define	CAP_FCNTL		0x0000000000001000ULL
-#define	CAP_FLOCK		0x0000000000004000ULL
-#define	CAP_FPATHCONF		0x0000000000002000ULL
-#define	CAP_FSCK		0x0000000000008000ULL
-#define	CAP_FSTAT		0x0000000000010000ULL
-#define	CAP_FSTATAT		CAP_FSTAT
-#define	CAP_FSTATFS		0x0000000000020000ULL
-#define	CAP_FUTIMES		0x0000000000040000ULL
-#define	CAP_FUTIMESAT		CAP_FUTIMES
-#define	CAP_LINKAT		0x0000000000400000ULL
-#define	CAP_MKDIRAT		0x0000000000200000ULL
-#define	CAP_MKFIFOAT		0x0000000000800000ULL
-#define	CAP_MKNODAT		0x0080000000000000ULL
-#define	CAP_RENAMEAT		0x0200000000000000ULL
-#define	CAP_SYMLINKAT		0x0100000000000000ULL
-#define	CAP_UNLINKAT		0x0000000000100000ULL
+#define	CAP_FTRUNCATE		CAPRIGHT(0, 0x0000000000000200ULL)
 
 /* Lookups - used to constrain *at() calls. */
-#define	CAP_LOOKUP		0x0000000001000000ULL
+#define	CAP_LOOKUP		CAPRIGHT(0, 0x0000000000000400ULL)
+
+/* VFS methods. */
+#define	CAP_FCHDIR		CAPRIGHT(0, 0x0000000000000800ULL)
+#define	CAP_FCHFLAGS		CAPRIGHT(0, 0x0000000000001000ULL)
+#define	CAP_CHFLAGSAT		(CAP_FCHFLAGS | CAP_LOOKUP)
+#define	CAP_FCHMOD		CAPRIGHT(0, 0x0000000000002000ULL)
+#define	CAP_FCHMODAT		(CAP_FCHMOD | CAP_LOOKUP)
+#define	CAP_FCHOWN		CAPRIGHT(0, 0x0000000000004000ULL)
+#define	CAP_FCHOWNAT		(CAP_FCHOWN | CAP_LOOKUP)
+#define	CAP_FCNTL		CAPRIGHT(0, 0x0000000000008000ULL)
+#define	CAP_FLOCK		CAPRIGHT(0, 0x0000000000010000ULL)
+#define	CAP_FPATHCONF		CAPRIGHT(0, 0x0000000000020000ULL)
+#define	CAP_FSCK		CAPRIGHT(0, 0x0000000000040000ULL)
+#define	CAP_FSTAT		CAPRIGHT(0, 0x0000000000080000ULL)
+#define	CAP_FSTATAT		(CAP_FSTAT | CAP_LOOKUP)
+#define	CAP_FSTATFS		CAPRIGHT(0, 0x0000000000100000ULL)
+#define	CAP_FUTIMES		CAPRIGHT(0, 0x0000000000200000ULL)
+#define	CAP_FUTIMESAT		(CAP_FUTIMES | CAP_LOOKUP)
+#define	CAP_LINKAT		CAPRIGHT(0, 0x0000000000400000ULL)
+#define	CAP_MKDIRAT		CAPRIGHT(0, 0x0000000000800000ULL)
+#define	CAP_MKFIFOAT		CAPRIGHT(0, 0x0000000001000000ULL)
+#define	CAP_MKNODAT		CAPRIGHT(0, 0x0000000002000000ULL)
+#define	CAP_RENAMEAT		CAPRIGHT(0, 0x0000000004000000ULL)
+#define	CAP_SYMLINKAT		CAPRIGHT(0, 0x0000000008000000ULL)
+#define	CAP_UNLINKAT		CAPRIGHT(0, 0x0000000010000000ULL)
 
 /* Extended attributes. */
-#define	CAP_EXTATTR_DELETE	0x0000000002000000ULL
-#define	CAP_EXTATTR_GET		0x0000000004000000ULL
-#define	CAP_EXTATTR_LIST	0x0000000008000000ULL
-#define	CAP_EXTATTR_SET		0x0000000010000000ULL
+#define	CAP_EXTATTR_DELETE	CAPRIGHT(0, 0x0000000020000000ULL)
+#define	CAP_EXTATTR_GET		CAPRIGHT(0, 0x0000000040000000ULL)
+#define	CAP_EXTATTR_LIST	CAPRIGHT(0, 0x0000000080000000ULL)
+#define	CAP_EXTATTR_SET		CAPRIGHT(0, 0x0000000100000000ULL)
 
 /* Access Control Lists. */
-#define	CAP_ACL_CHECK		0x0000000020000000ULL
-#define	CAP_ACL_DELETE		0x0000000040000000ULL
-#define	CAP_ACL_GET		0x0000000080000000ULL
-#define	CAP_ACL_SET		0x0000000100000000ULL
+#define	CAP_ACL_CHECK		CAPRIGHT(0, 0x0000000200000000ULL)
+#define	CAP_ACL_DELETE		CAPRIGHT(0, 0x0000000400000000ULL)
+#define	CAP_ACL_GET		CAPRIGHT(0, 0x0000000800000000ULL)
+#define	CAP_ACL_SET		CAPRIGHT(0, 0x0000001000000000ULL)
 
 /* Socket operations. */
-#define	CAP_ACCEPT		0x0000000200000000ULL
-#define	CAP_BIND		0x0000000400000000ULL
-#define	CAP_CONNECT		0x0000000800000000ULL
-#define	CAP_GETPEERNAME		0x0000001000000000ULL
-#define	CAP_GETSOCKNAME		0x0000002000000000ULL
-#define	CAP_GETSOCKOPT		0x0000004000000000ULL
-#define	CAP_LISTEN		0x0000008000000000ULL
-#define	CAP_PEELOFF		0x0000010000000000ULL
+#define	CAP_ACCEPT		CAPRIGHT(0, 0x0000002000000000ULL)
+#define	CAP_BIND		CAPRIGHT(0, 0x0000004000000000ULL)
+#define	CAP_CONNECT		CAPRIGHT(0, 0x0000008000000000ULL)
+#define	CAP_GETPEERNAME		CAPRIGHT(0, 0x0000010000000000ULL)
+#define	CAP_GETSOCKNAME		CAPRIGHT(0, 0x0000020000000000ULL)
+#define	CAP_GETSOCKOPT		CAPRIGHT(0, 0x0000040000000000ULL)
+#define	CAP_LISTEN		CAPRIGHT(0, 0x0000080000000000ULL)
+#define	CAP_PEELOFF		CAPRIGHT(0, 0x0000100000000000ULL)
 #define	CAP_RECV		CAP_READ
 #define	CAP_SEND		CAP_WRITE
-#define	CAP_SETSOCKOPT		0x0000020000000000ULL
-#define	CAP_SHUTDOWN		0x0000040000000000ULL
+#define	CAP_SETSOCKOPT		CAPRIGHT(0, 0x0000200000000000ULL)
+#define	CAP_SHUTDOWN		CAPRIGHT(0, 0x0000400000000000ULL)
 
 #define	CAP_SOCK_CLIENT \
 	(CAP_CONNECT | CAP_GETPEERNAME | CAP_GETSOCKNAME | CAP_GETSOCKOPT | \
@@ -161,56 +170,69 @@
 	 CAP_GETSOCKOPT | CAP_LISTEN | CAP_PEELOFF | CAP_RECV | CAP_SEND | \
 	 CAP_SETSOCKOPT | CAP_SHUTDOWN)
 
+/* All used bits for index 0. */
+#define	CAP_ALL0		CAPRIGHT(0, 0x00007FFFFFFFFFFFULL)
+
+/* Available bits for index 0. */
+#define	CAP_UNUSED0_48		CAPRIGHT(0, 0x0000800000000000ULL)
+/* ... */
+#define	CAP_UNUSED0_57		CAPRIGHT(0, 0x0100000000000000ULL)
+
+/* INDEX 1 */
+
 /* Mandatory Access Control. */
-#define	CAP_MAC_GET		0x0000080000000000ULL
-#define	CAP_MAC_SET		0x0000100000000000ULL
+#define	CAP_MAC_GET		CAPRIGHT(1, 0x0000000000000001ULL)
+#define	CAP_MAC_SET		CAPRIGHT(1, 0x0000000000000002ULL)
 
 /* Methods on semaphores. */
-#define	CAP_SEM_GETVALUE	0x0000200000000000ULL
-#define	CAP_SEM_POST		0x0000400000000000ULL
-#define	CAP_SEM_WAIT		0x0000800000000000ULL
+#define	CAP_SEM_GETVALUE	CAPRIGHT(1, 0x0000000000000004ULL)
+#define	CAP_SEM_POST		CAPRIGHT(1, 0x0000000000000008ULL)
+#define	CAP_SEM_WAIT		CAPRIGHT(1, 0x0000000000000010ULL)
 
 /* kqueue events. */
-#define	CAP_POLL_EVENT		0x0001000000000000ULL
-#define	CAP_POST_EVENT		0x0002000000000000ULL
+#define	CAP_POLL_EVENT		CAPRIGHT(1, 0x0000000000000020ULL)
+#define	CAP_POST_EVENT		CAPRIGHT(1, 0x0000000000000040ULL)
 
 /* Strange and powerful rights that should not be given lightly. */
-#define	CAP_IOCTL		0x0004000000000000ULL
-#define	CAP_TTYHOOK		0x0008000000000000ULL
+#define	CAP_IOCTL		CAPRIGHT(1, 0x0000000000000080ULL)
+#define	CAP_TTYHOOK		CAPRIGHT(1, 0x0000000000000100ULL)
 
 /* Process management via process descriptors. */
-#define	CAP_PDGETPID		0x0010000000000000ULL
-#define	CAP_PDWAIT		0x0020000000000000ULL
-#define	CAP_PDKILL		0x0040000000000000ULL
+#define	CAP_PDGETPID		CAPRIGHT(1, 0x0000000000000200ULL)
+#define	CAP_PDWAIT		CAPRIGHT(1, 0x0000000000000400ULL)
+#define	CAP_PDKILL		CAPRIGHT(1, 0x0000000000000800ULL)
 
 /*
  * Rights that allow to use bindat(2) and connectat(2) syscalls on a
  * directory descriptor.
  */
-#define	CAP_BINDAT		0x0400000000000000ULL
-#define	CAP_CONNECTAT		0x0800000000000000ULL
-
-/* The mask of all valid method rights. */
-#define	CAP_MASK_VALID		0x0fffffffffffffffULL
-#define	CAP_ALL			CAP_MASK_VALID
-
-/* Available bits. */
-#define	CAP_UNUSED3		0x1000000000000000ULL
-#define	CAP_UNUSED2		0x2000000000000000ULL
-#define	CAP_UNUSED1		0x4000000000000000ULL
-#define	CAP_UNUSED0		0x8000000000000000ULL
-
-/*
- * The following defines are provided for backward API compatibility and
- * should not be used in new code.
- */
-#define	CAP_MAPEXEC		CAP_MMAP_X
-#define	CAP_DELETE		CAP_UNLINKAT
-#define	CAP_MKDIR		CAP_MKDIRAT
-#define	CAP_RMDIR		CAP_UNLINKAT
-#define	CAP_MKFIFO		CAP_MKFIFOAT
-#define	CAP_MKNOD		CAP_MKNODAT
-#define	CAP_SOCK_ALL		(CAP_SOCK_CLIENT | CAP_SOCK_SERVER)
+#define	CAP_BINDAT		CAPRIGHT(1, 0x0000000000001000ULL)
+#define	CAP_CONNECTAT		CAPRIGHT(1, 0x0000000000002000ULL)
+
+/* All used bits for index 1. */
+#define	CAP_ALL1		CAPRIGHT(1, 0x0000000000003FFFULL)
+
+/* Available bits for index 1. */
+#define	CAP_UNUSED1_15		CAPRIGHT(1, 0x0000000000004000ULL)
+/* ... */
+#define	CAP_UNUSED1_57		CAPRIGHT(1, 0x0100000000000000ULL)
+
+#define	CAP_ALL(rights)		do {					\
+	(rights)->cr_rights[0] =					\
+	    ((uint64_t)CAP_RIGHTS_VERSION << 62) | CAP_ALL0;		\
+	(rights)->cr_rights[1] = CAP_ALL1;				\
+} while (0)
+
+#define	CAP_NONE(rights)	do {					\
+	(rights)->cr_rights[0] =					\
+	    ((uint64_t)CAP_RIGHTS_VERSION << 62) | CAPRIGHT(0, 0ULL);	\
+	(rights)->cr_rights[1] = CAPRIGHT(1, 0ULL);			\
+} while (0)
+
+#define	CAPRVER(right)		((int)((right) >> 62))
+#define	CAPVER(rights)		CAPRVER((rights)->cr_rights[0])
+#define	CAPARSIZE(rights)	(CAPVER(rights) + 2)
+#define	CAPIDXBIT(right)	((int)(((right) >> 57) & 0x1F))
 
 /*
  * Allowed fcntl(2) commands.
@@ -230,6 +252,27 @@
 
 #define	CAP_IOCTLS_ALL	SSIZE_MAX
 
+#define	cap_rights_init(...)						\
+	__cap_rights_init(CAP_RIGHTS_VERSION, __VA_ARGS__, 0ULL)
+cap_rights_t *__cap_rights_init(int version, cap_rights_t *rights, ...);
+
+#define	cap_rights_set(rights, ...)					\
+	__cap_rights_set((rights), __VA_ARGS__, 0ULL)
+void __cap_rights_set(cap_rights_t *rights, ...);
+
+#define	cap_rights_clear(rights, ...)					\
+	__cap_rights_clear((rights), __VA_ARGS__, 0ULL)
+void __cap_rights_clear(cap_rights_t *rights, ...);
+
+#define	cap_rights_is_set(rights, ...)					\
+	__cap_rights_is_set((rights), __VA_ARGS__, 0ULL)
+bool __cap_rights_is_set(const cap_rights_t *rights, ...);
+
+bool cap_rights_is_valid(const cap_rights_t *rights);
+void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
+void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
+bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);
+
 #ifdef _KERNEL
 
 #include <sys/systm.h>
@@ -241,17 +284,17 @@ struct filedesc;
 /*
  * Test whether a capability grants the requested rights.
  */
-int	cap_check(cap_rights_t have, cap_rights_t need);
+int	cap_check(const cap_rights_t *havep, const cap_rights_t *needp);
 /*
  * Convert capability rights into VM access flags.
  */
-u_char	cap_rights_to_vmprot(cap_rights_t have);
+u_char	cap_rights_to_vmprot(cap_rights_t *havep);
 
 /*
  * For the purposes of procstat(1) and similar tools, allow kern_descrip.c to
  * extract the rights from a capability.
  */
-cap_rights_t	cap_rights(struct filedesc *fdp, int fd);
+cap_rights_t	*cap_rights(struct filedesc *fdp, int fd);
 
 int	cap_ioctl_check(struct filedesc *fdp, int fd, u_long cmd);
 int	cap_fcntl_check(struct filedesc *fdp, int fd, int cmd);
@@ -259,18 +302,11 @@ int	cap_fcntl_check(struct filedesc *fdp, int fd, int cmd);
 #else /* !_KERNEL */
 
 __BEGIN_DECLS
-#include <stdbool.h>
-
 /*
  * cap_enter(): Cause the process to enter capability mode, which will
  * prevent it from directly accessing global namespaces.  System calls will
  * be limited to process-local, process-inherited, or file descriptor
  * operations.  If already in capability mode, a no-op.
- *
- * Currently, process-inherited operations are not properly handled -- in
- * particular, we're interested in things like waitpid(2), kill(2), etc,
- * being properly constrained.  One possible solution is to introduce process
- * descriptors.
  */
 int	cap_enter(void);
 
@@ -288,11 +324,12 @@ int	cap_getmode(u_int *modep);
 /*
  * Limits capability rights for the given descriptor (CAP_*).
  */
-int cap_rights_limit(int fd, cap_rights_t rights);
+int cap_rights_limit(int fd, const cap_rights_t *rights);
 /*
- * Returns bitmask of capability rights for the given descriptor.
+ * Returns capability rights for the given descriptor.
  */
-int cap_rights_get(int fd, cap_rights_t *rightsp);
+#define	cap_rights_get(fd, rights)	__cap_rights_get(CAP_RIGHTS_VERSION, (fd), (rights))
+int __cap_rights_get(int version, int fd, cap_rights_t *rightsp);
 /*
  * Limits allowed ioctls for the given descriptor.
  */
@@ -312,10 +349,6 @@ int cap_fcntls_limit(int fd, uint32_t fcntlrights);
  */
 int cap_fcntls_get(int fd, uint32_t *fcntlrightsp);
 
-/* For backward compatibility. */
-int cap_new(int fd, cap_rights_t rights);
-#define	cap_getrights(fd, rightsp)	cap_rights_get((fd), (rightsp))
-
 __END_DECLS
 
 #endif /* !_KERNEL */