Woo, this list has "my" syscall in! I originally wrote execveat() because I was experimenting with implementing FreeBSD's Capsicum[1] API on Linux, and I need

Woo, this list has "my" syscall in! I originally wrote execveat() because I was experimenting with implementing FreeBSD's Capsicum[1] API on Linux, and I needed a "true" fexec(). (Previously, glibc fexecve(fd,...) was implemented as execve("/proc/self/fd/N",...), which isn't so helpful in a sandbox where you aren't allowed to navigate the full filesystem.) Turns out, the Chrome team really wanted this too, and David Drysdale took on the work of polishing it up and getting it into the tree, so big props to him. [1] Capsicum is a sandbox based on per-file-descriptor permissions. Eg you could have a web server that can only append to files in its log directory, or read files from its Web root, but nothing else. Man pages: https://www.freebsd.org/cgi/man.cgi?capsicum(4) https://www.freebsd.org/cgi/man.cgi?capsicum(4) It's mentioned in the article, but I personally think Capsicum's syscall interface should have made this list too. File descriptors as capabilities is just so elegant!