We can use
cap_rights_limit for freezing and that's backwards compatible all the way to 10.x if not even 9.x, if I understand freezing correctly.
(and yes, this is not undoable even outside of the capability mode sandbox, I just tried to set
CAP_READ first and then set
CAP_MMAP_R — "Capabilities insufficient")
it means we can make one system call instead of two (shm_open + shm_unlink), and there's no chance of leaking a shared memory object in the unlikely case of a crash between those operations
Also, avoids any possible filesystem problems (e.g.
posix_fallocate not being supported by ZFS… well, not supported by shm either, but with shm the behavior is consistent on all machines)
and is absolutely necessary for Capsicum sandboxing which I'm working on :)