cheri.hh: add Capability::without_permissions
This pattern shows up in a few places.
diff --git a/sdk/include/cheri.hh b/sdk/include/cheri.hh
index 4663e17..0307cf7 100644
--- a/sdk/include/cheri.hh
+++ b/sdk/include/cheri.hh
@@ -813,6 +813,20 @@
}
/**
+ * Remove some permissions from this capability.
+ *
+ * Because this function computes the permission mask by clearing bits
+ * in the PermissionSet::omnipotent() all-ones mask, rather than from
+ * the set of permissions currently held by this Capability, it is safe
+ * to use to clear Global permission on a sealed capability.
+ */
+ template<std::same_as<Permission>... Permissions>
+ void without_permissions(Permissions... drop)
+ {
+ permissions() &= PermissionSet::omnipotent().without(drop...);
+ }
+
+ /**
* Pointer subtraction.
*/
Capability operator-(ptrdiff_t diff)
