21 files changed, 282 insertions, 8 deletions

diff --git a/lib/libcasper/Makefile.inc b/lib/libcasper/Makefile.inc
index 265f86d1ed55a..d6baedd2ed8e2 100644
--- a/lib/libcasper/Makefile.inc
+++ b/lib/libcasper/Makefile.inc
@@ -1,3 +1,9 @@
 # $FreeBSD$
 
+.include <src.opts.mk>
+
+.if ${MK_CASPER} != "no"
+CFLAGS+=-DWITH_CASPER
+.endif
+
 .include "../Makefile.inc"
diff --git a/lib/libcasper/libcasper/Makefile b/lib/libcasper/libcasper/Makefile
index c8eface43627e..75ac69bf55e8f 100644
--- a/lib/libcasper/libcasper/Makefile
+++ b/lib/libcasper/libcasper/Makefile
@@ -1,16 +1,21 @@
 # $FreeBSD$
 
+.include <src.opts.mk>
+
 PACKAGE=${LIB}
-LIB=	casper
 
 SHLIB_MAJOR=	0
 SHLIBDIR?=	/lib
 
+.if ${MK_CASPER} != "no"
+LIB=	casper
+
 SRCS=	libcasper.c
 SRCS+=	libcasper_impl.c
 SRCS+=	libcasper_service.c
 SRCS+=	service.c
 SRCS+=	zygote.c
+.endif
 
 INCS=	libcasper.h
 INCS+=	libcasper_service.h
diff --git a/lib/libcasper/libcasper/libcasper.h b/lib/libcasper/libcasper/libcasper.h
index 2d6f15825a392..a49561bcbd81d 100644
--- a/lib/libcasper/libcasper/libcasper.h
+++ b/lib/libcasper/libcasper/libcasper.h
@@ -1,6 +1,6 @@
 /*-
  * Copyright (c) 2012-2013 The FreeBSD Foundation
- * Copyright (c) 2015 Mariusz Zaborski <oshogbo@FreeBSD.org>
+ * Copyright (c) 2015-2017 Mariusz Zaborski <oshogbo@FreeBSD.org>
  * All rights reserved.
  *
  * This software was developed by Pawel Jakub Dawidek under sponsorship from
@@ -33,7 +33,15 @@
 #ifndef	_LIBCASPER_H_
 #define	_LIBCASPER_H_
 
+#ifdef HAVE_CASPER
+#define WITH_CASPER
+#endif
+
 #include <sys/types.h>
+#include <sys/nv.h>
+
+#include <stdlib.h>
+#include <unistd.h>
 
 #ifndef	_NVLIST_T_DECLARED
 #define	_NVLIST_T_DECLARED
@@ -44,72 +52,191 @@ typedef struct nvlist nvlist_t;
 
 #ifndef	_CAP_CHANNEL_T_DECLARED
 #define	_CAP_CHANNEL_T_DECLARED
+#ifdef WITH_CASPER
 struct cap_channel;
 
 typedef struct cap_channel cap_channel_t;
-#endif
+#else
+struct cap_channel {
+	int cch_fd;
+};
+typedef struct cap_channel cap_channel_t;
+#endif /* ! WITH_CASPER */
+#endif /* ! _CAP_CHANNEL_T_DECLARED */
 
 /*
  * The functions opens unrestricted communication channel to Casper.
  */
+#ifdef WITH_CASPER
 cap_channel_t *cap_init(void);
+#else
+static inline cap_channel_t *
+cap_init(void)
+{
+	cap_channel_t *chan;
+
+	chan = malloc(sizeof(*chan));
+	if (chan != NULL) {
+		chan->cch_fd = -1;
+	}
+	return (chan);
+}
+#endif
 
 /*
  * The functions to communicate with service.
  */
+#ifdef WITH_CASPER
 cap_channel_t	*cap_service_open(const cap_channel_t *chan, const char *name);
 int		 cap_service_limit(const cap_channel_t *chan,
 		    const char * const *names, size_t nnames);
+#else
+#define	cap_service_open(chan, name)		(cap_init())
+#define	cap_service_limit(chan, names, nnames)	(0)
+#endif
 
 /*
  * The function creates cap_channel_t based on the given socket.
  */
+#ifdef WITH_CASPER
 cap_channel_t *cap_wrap(int sock);
+#else
+static inline cap_channel_t *
+cap_wrap(int sock)
+{
+	cap_channel_t *chan;
+
+	chan = cap_init();
+	if (chan != NULL) {
+		chan->cch_fd = sock;
+	}
+	return (chan);
+}
+#endif
 
 /*
  * The function returns communication socket and frees cap_channel_t.
  */
+#ifdef WITH_CASPER
 int	cap_unwrap(cap_channel_t *chan);
+#else
+#define	cap_unwrap(chan)	(chan->cch_fd)
+#endif
 
 /*
  * The function clones the given capability.
  */
+#ifdef WITH_CASPER
 cap_channel_t *cap_clone(const cap_channel_t *chan);
+#else
+static inline cap_channel_t *
+cap_clone(const cap_channel_t *chan)
+{
+	cap_channel_t *newchan;
+
+	newchan = cap_init();
+	if (newchan == NULL) {
+		return (NULL);
+	}
+
+	if (chan->cch_fd == -1) {
+		newchan->cch_fd = -1;
+	} else {
+		newchan->cch_fd = dup(chan->cch_fd);
+		if (newchan->cch_fd < 0) {
+			free(newchan);
+			newchan = NULL;
+		}
+	}
+
+	return (newchan);
+}
+#endif
 
 /*
  * The function closes the given capability.
  */
+#ifdef WITH_CASPER
 void	cap_close(cap_channel_t *chan);
+#else
+static inline void
+cap_close(cap_channel_t *chan)
+{
+
+	if (chan->cch_fd >= 0) {
+		close(chan->cch_fd);
+	}
+	free(chan);
+}
+#endif
 
 /*
  * The function returns socket descriptor associated with the given
  * cap_channel_t for use with select(2)/kqueue(2)/etc.
  */
+#ifdef WITH_CASPER
 int	cap_sock(const cap_channel_t *chan);
+#else
+#define	cap_sock(chan)	(chan->cch_fd)
+#endif
 
 /*
  * The function limits the given capability.
  * It always destroys 'limits' on return.
  */
+#ifdef WITH_CASPER
 int	cap_limit_set(const cap_channel_t *chan, nvlist_t *limits);
+#else
+#define	cap_limit_set(chan, limits)	(0)
+#endif
 
 /*
  * The function returns current limits of the given capability.
  */
+#ifdef WITH_CASPER
 int	cap_limit_get(const cap_channel_t *chan, nvlist_t **limitsp);
+#else
+static inline int
+cap_limit_get(const cap_channel_t *chan __unused, nvlist_t **limitsp)
+{
+
+	*limitsp = nvlist_create(0);
+	return (0);
+}
+#endif
 
 /*
  * Function sends nvlist over the given capability.
  */
+#ifdef WITH_CASPER
 int	cap_send_nvlist(const cap_channel_t *chan, const nvlist_t *nvl);
+#else
+#define	cap_send_nvlist(chan, nvl)	(0)
+#endif
+
 /*
  * Function receives nvlist over the given capability.
  */
+#ifdef WITH_CASPER
 nvlist_t *cap_recv_nvlist(const cap_channel_t *chan, int flags);
+#else
+#define	cap_recv_nvlist(chan, flags)	(0)
+#endif
+
 /*
  * Function sends the given nvlist, destroys it and receives new nvlist in
  * response over the given capability.
  */
+#ifdef WITH_CASPER
 nvlist_t *cap_xfer_nvlist(const cap_channel_t *chan, nvlist_t *nvl, int flags);
+#else
+static inline nvlist_t *
+cap_xfer_nvlist(const cap_channel_t *chan __unused, nvlist_t *nvl, int flags)
+{
+
+	nvlist_destroy(nvl);
+	return (nvlist_create(flags));
+}
+#endif
 
 #endif	/* !_LIBCASPER_H_ */
diff --git a/lib/libcasper/services/Makefile b/lib/libcasper/services/Makefile
index 3eeac69d9857d..d14f34d5a3c36 100644
--- a/lib/libcasper/services/Makefile
+++ b/lib/libcasper/services/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+.include <src.opts.mk>
+
 SUBDIR=		cap_dns
 SUBDIR+=	cap_grp
 SUBDIR+=	cap_pwd
diff --git a/lib/libcasper/services/cap_dns/Makefile b/lib/libcasper/services/cap_dns/Makefile
index 4f89b0270ca3f..3e2daa2cfaaa3 100644
--- a/lib/libcasper/services/cap_dns/Makefile
+++ b/lib/libcasper/services/cap_dns/Makefile
@@ -5,12 +5,15 @@ SHLIBDIR?=	/lib/casper
 .include <src.opts.mk>
 
 PACKAGE=libcasper
-LIB=	cap_dns
 
 SHLIB_MAJOR=	0
 INCSDIR?=	${INCLUDEDIR}/casper
 
+.if ${MK_CASPER} != "no"
+LIB=	cap_dns
+
 SRCS=	cap_dns.c
+.endif
 
 INCS=	cap_dns.h
 
diff --git a/lib/libcasper/services/cap_dns/cap_dns.h b/lib/libcasper/services/cap_dns/cap_dns.h
index ea37542552861..d9d12bfd2c494 100644
--- a/lib/libcasper/services/cap_dns/cap_dns.h
+++ b/lib/libcasper/services/cap_dns/cap_dns.h
@@ -32,11 +32,16 @@
 #ifndef	_CAP_DNS_H_
 #define	_CAP_DNS_H_
 
+#ifdef HAVE_CASPER
+#define WITH_CASPER
+#endif
+
 #include <sys/socket.h>	/* socklen_t */
 
 struct addrinfo;
 struct hostent;
 
+#ifdef WITH_CASPER
 struct hostent *cap_gethostbyname(cap_channel_t *chan, const char *name);
 struct hostent *cap_gethostbyname2(cap_channel_t *chan, const char *name,
     int type);
@@ -53,5 +58,18 @@ int cap_dns_type_limit(cap_channel_t *chan, const char * const *types,
     size_t ntypes);
 int cap_dns_family_limit(cap_channel_t *chan, const int *families,
     size_t nfamilies);
+#else
+#define	cap_gethostbyname(chan, name)		 gethostbyname(name)
+#define cap_gethostbyname2(chan, name, type)	 gethostbyname2(name, type)
+#define cap_gethostbyaddr(chan, addr, len, type) gethostbyaddr(addr, len, type)
+
+#define	cap_getaddrinfo(chan, hostname, servname, hints, res)			\
+	getaddrinfo(hostname, servname, hints, res)
+#define	cap_getnameinfo(chan, sa, salen, host, hostlen, serv, servlen, flags)	\
+	getnameinfo(sa, salen, host, hostlen, serv, servlen, flags)
+
+#define	cap_dns_type_limit(chan, types, ntypes)		(0)
+#define cap_dns_family_limit(chan, families, nfamilies)	(0)
+#endif
 
 #endif	/* !_CAP_DNS_H_ */
diff --git a/lib/libcasper/services/cap_dns/tests/Makefile b/lib/libcasper/services/cap_dns/tests/Makefile
index 38af7117fe2ff..20049a06ccb7a 100644
--- a/lib/libcasper/services/cap_dns/tests/Makefile
+++ b/lib/libcasper/services/cap_dns/tests/Makefile
@@ -1,9 +1,13 @@
 # $FreeBSD$
 
+.include <src.opts.mk>
+
 TAP_TESTS_C=	dns_test
 
+.if ${MK_CASPER} != "no"
 LIBADD+=	casper
 LIBADD+=	cap_dns
+.endif
 LIBADD+=	nv
 
 WARNS?=		3
diff --git a/lib/libcasper/services/cap_dns/tests/dns_test.c b/lib/libcasper/services/cap_dns/tests/dns_test.c
index 0629869c69b2a..66469604afa06 100644
--- a/lib/libcasper/services/cap_dns/tests/dns_test.c
+++ b/lib/libcasper/services/cap_dns/tests/dns_test.c
@@ -31,6 +31,7 @@
 __FBSDID("$FreeBSD$");
 
 #include <sys/capsicum.h>
+#include <sys/nv.h>
 
 #include <arpa/inet.h>
 #include <netinet/in.h>
diff --git a/lib/libcasper/services/cap_grp/Makefile b/lib/libcasper/services/cap_grp/Makefile
index 5fba3d2ba7b0b..d15cd72c20ce9 100644
--- a/lib/libcasper/services/cap_grp/Makefile
+++ b/lib/libcasper/services/cap_grp/Makefile
@@ -5,12 +5,15 @@ SHLIBDIR?=	/lib/casper
 .include <src.opts.mk>
 
 PACKAGE=libcasper
-LIB=	cap_grp
 
 SHLIB_MAJOR=	0
 INCSDIR?=	${INCLUDEDIR}/casper
 
+.if ${MK_CASPER} != "no"
+LIB=	cap_grp
+
 SRCS=	cap_grp.c
+.endif
 
 INCS=	cap_grp.h
 
diff --git a/lib/libcasper/services/cap_grp/cap_grp.h b/lib/libcasper/services/cap_grp/cap_grp.h
index 68595c145e230..84b9c7bab034d 100644
--- a/lib/libcasper/services/cap_grp/cap_grp.h
+++ b/lib/libcasper/services/cap_grp/cap_grp.h
@@ -32,6 +32,11 @@
 #ifndef	_CAP_GRP_H_
 #define	_CAP_GRP_H_
 
+#ifdef HAVE_CASPER
+#define WITH_CASPER
+#endif
+
+#ifdef WITH_CASPER
 struct group *cap_getgrent(cap_channel_t *chan);
 struct group *cap_getgrnam(cap_channel_t *chan, const char *name);
 struct group *cap_getgrgid(cap_channel_t *chan, gid_t gid);
@@ -53,5 +58,32 @@ int cap_grp_limit_fields(cap_channel_t *chan, const char * const *fields,
     size_t nfields);
 int cap_grp_limit_groups(cap_channel_t *chan, const char * const *names,
     size_t nnames, gid_t *gids, size_t ngids);
+#else
+#define	cap_getgrent(chan)		getgrent()
+#define	cap_getgrnam(chan, name)	getgrnam(name)
+#define	cap_getgrgid(chan, gid)		getgrgid(gid)
+
+#define	cap_setgroupent(chan, stayopen) etgroupent(stayopen)
+#define endgrent(chan)			endgrent()
+inline int
+cap_setgrent(cap_channel_t *chan __unused)
+{
+
+	setgrent();
+	return(0);
+}
+
+#define	cap_getgrent_r(chan, grp, buffer, bufsize, result)			\
+	getgrent_r(grp, buffer, bufsize, result)
+#define	cap_getgrnam_r(chan, name, grp, buffer, bufsize, result)		\
+	getgrnam_r(name, grp, buffer, bufsize, result)
+#define	cap_getgrgid_r(chan, gid, grp, buffer, bufsize, result)			\
+	getgrgid_r(gid, grp, buffer, bufsize, result)
+
+#define	cap_grp_limit_cmds(chan, cmds, ncmds)			(0)
+#define	cap_grp_limit_fields(chan, fields, nfields)		(0)
+#define	cap_grp_limit_groups(chan, names, nnames, gids, ngids)	(0)
+
+#endif
 
 #endif	/* !_CAP_GRP_H_ */
diff --git a/lib/libcasper/services/cap_grp/tests/Makefile b/lib/libcasper/services/cap_grp/tests/Makefile
index 656188513188d..b1b7e05d0ee28 100644
--- a/lib/libcasper/services/cap_grp/tests/Makefile
+++ b/lib/libcasper/services/cap_grp/tests/Makefile
@@ -1,9 +1,13 @@
 # $FreeBSD$
 
+.include <src.opts.mk>
+
 TAP_TESTS_C=	grp_test
 
+.if ${MK_CASPER} != "no"
 LIBADD+=	casper
 LIBADD+=	cap_grp
+.endif
 LIBADD+=	nv
 
 WARNS?=		3
diff --git a/lib/libcasper/services/cap_grp/tests/grp_test.c b/lib/libcasper/services/cap_grp/tests/grp_test.c
index cdda7c6a4d703..05cf09e81ef8f 100644
--- a/lib/libcasper/services/cap_grp/tests/grp_test.c
+++ b/lib/libcasper/services/cap_grp/tests/grp_test.c
@@ -31,6 +31,7 @@
 __FBSDID("$FreeBSD$");
 
 #include <sys/capsicum.h>
+#include <sys/nv.h>
 
 #include <assert.h>
 #include <err.h>
diff --git a/lib/libcasper/services/cap_pwd/Makefile b/lib/libcasper/services/cap_pwd/Makefile
index e8c87d47b9236..fc2a32850f79b 100644
--- a/lib/libcasper/services/cap_pwd/Makefile
+++ b/lib/libcasper/services/cap_pwd/Makefile
@@ -5,12 +5,15 @@ SHLIBDIR?=	/lib/casper
 .include <src.opts.mk>
 
 PACKAGE=libcasper
-LIB=	cap_pwd
 
 SHLIB_MAJOR=	0
 INCSDIR?=	${INCLUDEDIR}/casper
 
+.if ${MK_CASPER} != "no"
+LIB=	cap_pwd
+
 SRCS=	cap_pwd.c
+.endif
 
 INCS=	cap_pwd.h
 
diff --git a/lib/libcasper/services/cap_pwd/cap_pwd.h b/lib/libcasper/services/cap_pwd/cap_pwd.h
index a75fba74f9727..99b643174910b 100644
--- a/lib/libcasper/services/cap_pwd/cap_pwd.h
+++ b/lib/libcasper/services/cap_pwd/cap_pwd.h
@@ -32,6 +32,11 @@
 #ifndef	_CAP_PWD_H_
 #define	_CAP_PWD_H_
 
+#ifdef HAVE_CASPER
+#define WITH_CASPER
+#endif
+
+#ifdef WITH_CASPER
 struct passwd *cap_getpwent(cap_channel_t *chan);
 struct passwd *cap_getpwnam(cap_channel_t *chan, const char *login);
 struct passwd *cap_getpwuid(cap_channel_t *chan, uid_t uid);
@@ -53,5 +58,25 @@ int cap_pwd_limit_fields(cap_channel_t *chan, const char * const *fields,
     size_t nfields);
 int cap_pwd_limit_users(cap_channel_t *chan, const char * const *names,
     size_t nnames, uid_t *uids, size_t nuids);
+#else
+#define	cap_getpwent(chan)		getpwent()
+#define	cap_getpwnam(chan, login)	getpwnam(login)
+#define	cap_getpwuid(chan, uid)		getpwuid(uid)
+
+#define	cap_getpwent_r(chan, pwd, buffer, bufsize, result)			\
+	getpwent_r(pwd, buffer, bufsize, result)
+#define	cap_getpwnam_r(chan, name, pwd, buffer, bufsize, result)		\
+	getpwnam_r(name, pwd, buffer, bufsize, result)
+#define	cap_getpwuid_r(chan, uid, pwd, buffer, bufsize, result)			\
+	getpwuid_r(uid, pwd, buffer, bufsize, result)
+
+#define	cap_setpassent(chan, stayopen)	setpassent(stayopen)
+#define	cap_setpwent(chan)		setpwent()
+#define	cap_endpwent(chan)		endpwent()
+
+#define	cap_pwd_limit_cmds(chan, cmds, ncmds)			(0)
+#define cap_pwd_limit_fields(chan, fields, nfields)		(0)
+#define cap_pwd_limit_users(chan, names, nnames, uids, nuids)	(0)
+#endif
 
 #endif	/* !_CAP_PWD_H_ */
diff --git a/lib/libcasper/services/cap_pwd/tests/Makefile b/lib/libcasper/services/cap_pwd/tests/Makefile
index 8c88753e59d18..b4e75d346fc90 100644
--- a/lib/libcasper/services/cap_pwd/tests/Makefile
+++ b/lib/libcasper/services/cap_pwd/tests/Makefile
@@ -1,9 +1,13 @@
 # $FreeBSD$
 
+.include <src.opts.mk>
+
 TAP_TESTS_C=	pwd_test
 
+.if ${MK_CASPER} != "no"
 LIBADD+=	casper
 LIBADD+=	cap_pwd
+.endif
 LIBADD+=	nv
 
 WARNS?=		3
diff --git a/lib/libcasper/services/cap_pwd/tests/pwd_test.c b/lib/libcasper/services/cap_pwd/tests/pwd_test.c
index e5764dba63058..a906788204fad 100644
--- a/lib/libcasper/services/cap_pwd/tests/pwd_test.c
+++ b/lib/libcasper/services/cap_pwd/tests/pwd_test.c
@@ -31,6 +31,7 @@
 __FBSDID("$FreeBSD$");
 
 #include <sys/capsicum.h>
+#include <sys/nv.h>
 
 #include <assert.h>
 #include <err.h>
diff --git a/lib/libcasper/services/cap_random/Makefile b/lib/libcasper/services/cap_random/Makefile
index 97a27beb134a6..d29cd147aeb0d 100644
--- a/lib/libcasper/services/cap_random/Makefile
+++ b/lib/libcasper/services/cap_random/Makefile
@@ -1,13 +1,18 @@
 # $FreeBSD$
 
+.include <src.opts.mk>
+
 PACKAGE=libcasper
-LIB=	cap_random
 
 SHLIB_MAJOR=	0
 SHLIBDIR?=	/lib/casper
 INCSDIR?=	${INCLUDEDIR}/casper
 
+.if ${MK_CASPER} != "no"
+LIB=	cap_random
+
 SRCS=	cap_random.c
+.endif
 
 INCS=	cap_random.h
 
diff --git a/lib/libcasper/services/cap_random/cap_random.h b/lib/libcasper/services/cap_random/cap_random.h
index 2039b5fe84602..2c37b9c618d49 100644
--- a/lib/libcasper/services/cap_random/cap_random.h
+++ b/lib/libcasper/services/cap_random/cap_random.h
@@ -32,6 +32,20 @@
 #ifndef	_CAP_RANDOM_H_
 #define	_CAP_RANDOM_H_
 
+#ifdef HAVE_CASPER
+#define WITH_CASPER
+#endif
+
+#ifdef WITH_CASPER
 int cap_random_buf(cap_channel_t *chan, void *buf, size_t nbytes);
+#else
+inline int
+cap_random_buf(cap_channel_t *chan, void *buf, size_t nbytes)
+{
+
+	arc4random_buf(buf, nbytes);
+	return(0);
+}
+#endif
 
 #endif	/* !_CAP_RANDOM_H_ */
diff --git a/lib/libcasper/services/cap_sysctl/Makefile b/lib/libcasper/services/cap_sysctl/Makefile
index 5b99601619326..cd5c4b2387245 100644
--- a/lib/libcasper/services/cap_sysctl/Makefile
+++ b/lib/libcasper/services/cap_sysctl/Makefile
@@ -5,12 +5,15 @@ SHLIBDIR?=	/lib/casper
 .include <src.opts.mk>
 
 PACKAGE=libcasper
-LIB=	cap_sysctl
 
 SHLIB_MAJOR=	0
 INCSDIR?=	${INCLUDEDIR}/casper
 
+.if ${MK_CASPER} != "no"
+LIB=	cap_sysctl
+
 SRCS=	cap_sysctl.c
+.endif
 
 INCS=	cap_sysctl.h
 
diff --git a/lib/libcasper/services/cap_sysctl/cap_sysctl.h b/lib/libcasper/services/cap_sysctl/cap_sysctl.h
index 2af6d21576958..6532874f2e941 100644
--- a/lib/libcasper/services/cap_sysctl/cap_sysctl.h
+++ b/lib/libcasper/services/cap_sysctl/cap_sysctl.h
@@ -32,12 +32,21 @@
 #ifndef	_CAP_SYSCTL_H_
 #define	_CAP_SYSCTL_H_
 
+#ifdef HAVE_CASPER
+#define WITH_CASPER
+#endif
+
 #define	CAP_SYSCTL_READ		0x01
 #define	CAP_SYSCTL_WRITE	0x02
 #define	CAP_SYSCTL_RDWR		(CAP_SYSCTL_READ | CAP_SYSCTL_WRITE)
 #define	CAP_SYSCTL_RECURSIVE	0x04
 
+#ifdef WITH_CASPER
 int cap_sysctlbyname(cap_channel_t *chan, const char *name, void *oldp,
     size_t *oldlenp, const void *newp, size_t newlen);
+#else
+#define	cap_sysctlbyname(chan, name, oldp, oldlenp, newp, newlen)		\
+	sysctlbyname(name, oldp, oldlenp, newp, newlen)
+#endif
 
 #endif	/* !_CAP_SYSCTL_H_ */
diff --git a/lib/libcasper/services/cap_sysctl/tests/Makefile b/lib/libcasper/services/cap_sysctl/tests/Makefile
index cd0f3bb5d7490..b11c45fb65630 100644
--- a/lib/libcasper/services/cap_sysctl/tests/Makefile
+++ b/lib/libcasper/services/cap_sysctl/tests/Makefile
@@ -1,9 +1,13 @@
 # $FreeBSD$
 
+.include <src.opts.mk>
+
 TAP_TESTS_C=	sysctl_test
 
+.if ${MK_CASPER} != "no"
 LIBADD+=	casper
 LIBADD+=	cap_sysctl
+.endif
 LIBADD+=	nv
 
 WARNS?=		3