Difference between revisions of "Capabilities and Flags"

From Linux-VServer

Jump to: navigation, search
 
Line 1: Line 1:
−
Below is a list of capabilities and flags used for contexts and processes within.
+
__NOTOC__
  
−
== System capabilities (bcaps) ==
+
Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:
  
−
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.
+
; Bit : The bit number to enable the capability/flag
 +
; Mask : The bit number in hexadecimal notation
 +
; Name : Human readable identifier used in userspace utilities
 +
; Tag : Special capability/flag code to denote special behaviour, legacy usage and others (see below)
 +
; Description : Description of capability/flag effects
  
−
{| class="wikitable"
+
== Special capability/flags codes ==
−
! Bit
+
−
! Mask
+
−
! Name
+
−
! Description
+
−
|-
+
−
| 0
+
−
| 0x00000001
+
−
| CAP_CHOWN
+
−
|
+
−
In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this
+
−
overrides the restriction of changing file ownership and group
+
−
ownership.
+
  
−
|-
+
The tag column may contain one or more of the following tags:
−
| 1
+
−
| 0x00000002
+
−
| CAP_DAC_OVERRIDE
+
−
|
+
−
Override all DAC access, including ACL execute access if
+
−
[_POSIX_ACL] is defined. Excluding DAC access covered by
+
−
CAP_LINUX_IMMUTABLE.
+
  
 +
{| class="wikitable_inline"
 +
! Tag
 +
! Description
 
|-
 
|-
−
| 2
+
| I
−
| 0x00000004
+
| Internal use only
−
| CAP_DAC_READ_SEARCH
+
−
|
+
−
Overrides all DAC restrictions regarding read and search on files
+
−
and directories, including ACL restrictions if [_POSIX_ACL] is
+
−
defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
+
−
 
+
 
|-
 
|-
−
| 3
+
| L
−
| 0x00000008
+
| Only supported with legacy enabled
−
| CAP_FOWNER
+
−
|
+
−
Overrides all restrictions about allowed operations on files, where
+
−
file owner ID must be equal to the user ID, except where CAP_FSETID
+
−
is applicable. It doesn't override MAC and DAC restrictions.
+
−
 
+
 
|-
 
|-
−
| 4
+
| O
−
| 0x00000010
+
| One time capability/flag
−
| CAP_FSETID
+
−
|
+
−
Overrides the following restrictions that the effective user ID
+
−
shall match the file owner ID when setting the S_ISUID and S_ISGID
+
−
bits on that file; that the effective group ID (or one of the
+
−
supplementary group IDs) shall match the file owner ID when setting
+
−
the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are
+
−
cleared on successful return from chown(2) (not implemented).
+
−
 
+
 
|-
 
|-
−
| 5
+
| U
−
| 0x00000020
+
| Unsupported
−
| CAP_KILL
+
−
|
+
−
Overrides the restriction that the real or effective user ID of a
+
−
process sending a signal must match the real or effective user ID
+
−
of the process receiving the signal.
+
−
 
+
 
|-
 
|-
−
| 6
+
| X
−
| 0x00000040
+
| Slightly different meaning in legacy
−
| CAP_SETGID
+
−
|
+
−
Allows setgid(2) manipulation<br />
+
−
Allows setgroups(2)<br />
+
−
Allows forged gids on socket credentials passing.
+
−
 
+
−
|-
+
−
| 7
+
−
| 0x00000080
+
−
| CAP_SETUID
+
−
|
+
−
Allows set*uid(2) manipulation (including fsuid).<br />
+
−
Allows forged pids on socket credentials passing.
+
−
 
+
−
|-
+
−
| 8
+
−
| 0x00000100
+
−
| CAP_SETPCAP
+
−
|
+
−
Transfer any capability in your permitted set to any pid,
+
−
remove any capability in your permitted set from any pid
+
−
 
+
−
|-
+
−
| 9
+
−
| 0x00000200
+
−
| CAP_LINUX_IMMUTABLE
+
−
|
+
−
Allow modification of S_IMMUTABLE and S_APPEND file attributes
+
−
 
+
−
|-
+
−
| 10
+
−
| 0x00000400
+
−
| CAP_NET_BIND_SERVICE
+
−
|
+
−
Allows binding to TCP/UDP sockets below 1024<br />
+
−
Allows binding to ATM VCIs below 32
+
−
 
+
−
|-
+
−
| 11
+
−
| 0x00000800
+
−
| CAP_NET_BROADCAST
+
−
|
+
−
Allow broadcasting, listen to multicast
+
−
 
+
−
|-
+
−
| 12
+
−
| 0x00001000
+
−
| CAP_NET_ADMIN
+
−
|
+
−
Allow interface configuration<br />
+
−
Allow administration of IP firewall, masquerading and accounting<br />
+
−
Allow setting debug option on sockets<br />
+
−
Allow modification of routing tables<br />
+
−
Allow setting arbitrary process / process group ownership on
+
−
sockets<br />
+
−
Allow binding to any address for transparent proxying<br />
+
−
Allow setting TOS (type of service)<br />
+
−
Allow setting promiscuous mode<br />
+
−
Allow clearing driver statistics<br />
+
−
Allow multicasting<br />
+
−
Allow read/write of device-specific registers<br />
+
−
Allow activation of ATM control sockets
+
−
 
+
−
|-
+
−
| 13
+
−
| 0x00002000
+
−
| CAP_NET_RAW
+
−
|
+
−
Allow use of RAW sockets<br />
+
−
Allow use of PACKET sockets
+
−
 
+
−
|-
+
−
| 14
+
−
| 0x00004000
+
−
| CAP_IPC_LOCK
+
−
|
+
−
Allow locking of shared memory segments<br />
+
−
Allow mlock and mlockall (which doesn't really have anything to do
+
−
with IPC)
+
−
 
+
−
|-
+
−
| 15
+
−
| 0x00008000
+
−
| CAP_IPC_OWNER
+
−
|
+
−
Override IPC ownership checks
+
−
 
+
−
|-
+
−
| 16
+
−
| 0x00010000
+
−
| CAP_SYS_MODULE
+
−
|
+
−
Insert and remove kernel modules - modify kernel without limit<br />
+
−
Modify cap_bset
+
−
 
+
−
|-
+
−
| 17
+
−
| 0x00020000
+
−
| CAP_SYS_RAWIO
+
−
|
+
−
Allow ioperm/iopl access<br />
+
−
Allow sending USB messages to any device via /proc/bus/usb
+
−
 
+
−
|-
+
−
| 18
+
−
| 0x00040000
+
−
| CAP_SYS_CHROOT
+
−
|
+
−
Allow use of chroot()
+
−
 
+
−
|-
+
−
| 19
+
−
| 0x00080000
+
−
| CAP_SYS_PTRACE
+
−
|
+
−
Allow ptrace() of any process
+
−
 
+
−
|-
+
−
| 20
+
−
| 0x00100000
+
−
| CAP_SYS_PACCT
+
−
|
+
−
Allow configuration of process accounting
+
−
 
+
−
|-
+
−
| 21
+
−
| 0x00200000
+
−
| CAP_SYS_ADMIN
+
−
|
+
−
Allow configuration of the secure attention key<br />
+
−
Allow administration of the random device<br />
+
−
Allow examination and configuration of disk quotas<br />
+
−
Allow configuring the kernel's syslog (printk behaviour)<br />
+
−
Allow setting the domainname<br />
+
−
Allow setting the hostname<br />
+
−
Allow calling bdflush()<br />
+
−
Allow mount() and umount(), setting up new smb connection<br />
+
−
Allow some autofs root ioctls<br />
+
−
Allow nfsservctl<br />
+
−
Allow VM86_REQUEST_IRQ<br />
+
−
Allow to read/write pci config on alpha<br />
+
−
Allow irix_prctl on mips (setstacksize)<br />
+
−
Allow flushing all cache on m68k (sys_cacheflush)<br />
+
−
Allow removing semaphores<br />
+
−
Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores
+
−
and shared memory<br />
+
−
Allow locking/unlocking of shared memory segment<br />
+
−
Allow turning swap on/off<br />
+
−
Allow forged pids on socket credentials passing<br />
+
−
Allow setting readahead and flushing buffers on block devices<br />
+
−
Allow setting geometry in floppy driver<br />
+
−
Allow turning DMA on/off in xd driver<br />
+
−
Allow administration of md devices (mostly the above, but some
+
−
extra ioctls)<br />
+
−
Allow tuning the ide driver<br />
+
−
Allow access to the nvram device<br />
+
−
Allow administration of apm_bios, serial and bttv (TV) device<br />
+
−
Allow manufacturer commands in isdn CAPI support driver<br />
+
−
Allow reading non-standardized portions of pci configuration space<br />
+
−
Allow DDI debug ioctl on sbpcd driver<br />
+
−
Allow setting up serial ports<br />
+
−
Allow sending raw qic-117 commands<br />
+
−
Allow enabling/disabling tagged queuing on SCSI controllers and sending
+
−
arbitrary SCSI commands<br />
+
−
Allow setting encryption key on loopback filesystem<br />
+
−
Allow setting zone reclaim policy
+
−
 
+
−
|-
+
−
| 22
+
−
| 0x00400000
+
−
| CAP_SYS_BOOT
+
−
|
+
−
Allow use of reboot()
+
−
 
+
−
|-
+
−
| 23
+
−
| 0x00800000
+
−
| CAP_SYS_NICE
+
−
|
+
−
Allow raising priority and setting priority on other (different
+
−
UID) processes<br />
+
−
Allow use of FIFO and round-robin (realtime) scheduling on own
+
−
processes and setting the scheduling algorithm used by another
+
−
process.<br />
+
−
Allow setting cpu affinity on other processes
+
−
 
+
−
|-
+
−
| 24
+
−
| 0x01000000
+
−
| CAP_SYS_RESOURCE
+
−
|
+
−
Override resource limits. Set resource limits.<br />
+
−
Override quota limits.<br />
+
−
Override reserved space on ext2 filesystem<br />
+
−
Modify data journaling mode on ext3 filesystem (uses journaling
+
−
resources)<br />
+
−
''NOTE:'' ext2 honors fsuid when checking for resource overrides, so
+
−
you can override using fsuid too<br />
+
−
Override size restrictions on IPC message queues<br />
+
−
Allow more than 64hz interrupts from the real-time clock<br />
+
−
Override max number of consoles on console allocation<br />
+
−
Override max number of keymaps
+
−
 
+
−
|-
+
−
| 25
+
−
| 0x02000000
+
−
| CAP_SYS_TIME
+
−
|
+
−
Allow manipulation of system clock<br />
+
−
Allow irix_stime on mips<br />
+
−
Allow setting the real-time clock
+
−
 
+
−
|-
+
−
| 26
+
−
| 0x04000000
+
−
| CAP_SYS_TTY_CONFIG
+
−
|
+
−
Allow configuration of tty devices<br />
+
−
Allow vhangup() of tty
+
−
 
+
−
|-
+
−
| 27
+
−
| 0x08000000
+
−
| CAP_MKNOD
+
−
|
+
−
Allow the privileged aspects of mknod()
+
−
 
+
−
|-
+
−
| 28
+
−
| 0x10000000
+
−
| CAP_LEASE
+
−
|
+
−
Allow taking of leases on files
+
−
 
+
−
|-
+
−
| 29
+
−
| 0x20000000
+
−
| CAP_AUDIT_WRITE
+
−
|
+
−
??
+
−
|-
+
−
| 30
+
−
| 0x40000000
+
−
| CAP_AUDIT_CONTROL
+
−
|
+
−
??
+
 
|}
 
|}
  
Line 322: Line 37:
 
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.
 
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.
  
−
{| class="wikitable"
+
{| class="wikitable_list"
 
! Bit
 
! Bit
 
! Mask
 
! Mask
 
! Name
 
! Name
 +
! Tag
 
! Description
 
! Description
 
|-
 
|-
 
| 0
 
| 0
 
| 0x00000001
 
| 0x00000001
−
| VXC_SET_UTSNAME
+
| SET_UTSNAME
 
|
 
|
−
Allow setdomainname(2) and sethostname(2)
+
| Allow setdomainname(2) and sethostname(2)
 
|-
 
|-
 
| 1
 
| 1
 
| 0x00000002
 
| 0x00000002
−
| VXC_SET_RLIMIT
+
| SET_RLIMIT
 
|
 
|
−
Allow setrlimit(2)
+
| Allow setrlimit(2)
 
|-
 
|-
 
| 8
 
| 8
 
| 0x00000100
 
| 0x00000100
−
| VXC_RAW_ICMP
+
| RAW_ICMP
 
|
 
|
−
Allow usage of raw ICMP sockets
+
| Allow usage of raw ICMP sockets
 
|-
 
|-
 
| 12
 
| 12
 
| 0x00001000
 
| 0x00001000
−
| VXC_SYSLOG
+
| SYSLOG
 
|
 
|
−
Allow syslog(2)
+
| Allow syslog(2)
 
|-
 
|-
 
| 16
 
| 16
 
| 0x00010000
 
| 0x00010000
−
| VXC_SECURE_MOUNT
+
| SECURE_MOUNT
 
|
 
|
−
Allow secure mount(2)
+
| Allow secure mount(2)
 
|-
 
|-
 
| 17
 
| 17
 
| 0x00020000
 
| 0x00020000
−
| VXC_SECURE_REMOUNT
+
| SECURE_REMOUNT
 
|
 
|
−
Allow secure remount
+
| Allow secure remount
 
|-
 
|-
 
| 18
 
| 18
 
| 0x00040000
 
| 0x00040000
−
| VXC_BINARY_MOUNT
+
| BINARY_MOUNT
 
|
 
|
−
Allow binary/network mounts
+
| Allow binary/network mounts
 
|-
 
|-
 
| 20
 
| 20
 
| 0x00100000
 
| 0x00100000
−
| VXC_QUOTA_CTL
+
| QUOTA_CTL
 
|
 
|
−
Allow quota ioctls
+
| Allow quota ioctls
 
|-
 
|-
 
| 21
 
| 21
 
| 0x00200000
 
| 0x00200000
−
| VXC_ADMIN_MAPPER
+
| ADMIN_MAPPER
 
|
 
|
−
Allow access to device mapper
+
| Allow access to device mapper
 
|-
 
|-
 
| 22
 
| 22
 
| 0x00400000
 
| 0x00400000
−
| VXC_ADMIN_CLOOP
+
| ADMIN_CLOOP
 
|
 
|
−
Allow access to loop devices
+
| Allow access to loop devices
 
|}
 
|}
  
Line 393: Line 109:
 
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.
 
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.
  
−
{| class="wikitable"
+
{| class="wikitable_list"
 
! Bit
 
! Bit
 
! Mask
 
! Mask
 
! Name
 
! Name
 +
! Tag
 
! Description
 
! Description
 
|-
 
|-
 
| 0
 
| 0
 
| 0x00000001
 
| 0x00000001
−
| VXF_INFO_LOCK
+
| INFO_LOCK
−
|
+
| L
−
Prohibit further context migration
+
| Prohibit further context migration
 
|-
 
|-
 
| 1
 
| 1
 
| 0x00000002
 
| 0x00000002
−
| VXF_INFO_SCHED
+
| INFO_SCHED
−
|
+
| L
−
Account all processes as one (Legacy)
+
| Account all processes as one
 
|-
 
|-
 
| 2
 
| 2
 
| 0x00000004
 
| 0x00000004
−
| VXF_INFO_NPROC
+
| INFO_NPROC
−
|
+
| L
−
Apply process limits to context (Legacy)
+
| Apply process limits to context
 
|-
 
|-
 
| 3
 
| 3
 
| 0x00000008
 
| 0x00000008
−
| VXF_INFO_PRIVATE
+
| INFO_PRIVATE
−
|
+
| L
−
Context cannot be entered (Legacy)
+
| Context cannot be entered
 
|-
 
|-
 
| 4
 
| 4
 
| 0x00000010
 
| 0x00000010
−
| VXF_INFO_INIT
+
| INFO_INIT
−
|
+
| X
−
Show a fake init process
+
| Show a fake init process
 
|-
 
|-
 
| 5
 
| 5
 
| 0x00000020
 
| 0x00000020
−
| VXF_INFO_HIDE
+
| INFO_HIDE
−
|
+
| X
−
Hide context information in task status
+
| Hide context information in task status
 
|-
 
|-
 
| 6
 
| 6
 
| 0x00000040
 
| 0x00000040
−
| VXF_INFO_ULIMIT
+
| INFO_ULIMIT
−
|
+
| L
−
Apply ulimits to context (Legacy)
+
| Apply ulimits to context
 
|-
 
|-
 
| 7
 
| 7
 
| 0x00000080
 
| 0x00000080
−
| VXF_INFO_NSPACE
+
| INFO_NSPACE
−
|
+
| L
−
Use private namespace (Legacy)
+
| Use private namespace
 
|-
 
|-
 
| 8
 
| 8
 
| 0x00000100
 
| 0x00000100
−
| VXF_SCHED_HARD
+
| SCHED_HARD
 
|
 
|
−
Enable hard scheduler
+
| Enable hard scheduler
 
|-
 
|-
 
| 9
 
| 9
 
| 0x00000200
 
| 0x00000200
−
| VXF_SCHED_PRIO
+
| SCHED_PRIO
 
|
 
|
−
Enable priority scheduler
+
| Enable priority scheduler
 
|-
 
|-
 
| 10
 
| 10
 
| 0x00000400
 
| 0x00000400
−
| VXF_SCHED_PAUSE
+
| SCHED_PAUSE
 
|
 
|
−
Pause context (unschedule)
+
| Pause context (unschedule)
 
|-
 
|-
 
| 20
 
| 20
 
| 0x00010000
 
| 0x00010000
−
| VXF_VIRT_MEM
+
| VIRT_MEM
 
|
 
|
−
Virtualize memory information
+
| Virtualize memory information
 
|-
 
|-
 
| 21
 
| 21
 
| 0x00020000
 
| 0x00020000
−
| VXF_VIRT_UPTIME
+
| VIRT_UPTIME
 
|
 
|
−
Virtualize uptime information
+
| Virtualize uptime information
 
|-
 
|-
 
| 22
 
| 22
 
| 0x00040000
 
| 0x00040000
−
| VXF_VIRT_CPU
+
| VIRT_CPU
 
|
 
|
−
Virtualize cpu usage information
+
| Virtualize cpu usage information
 
|-
 
|-
 
| 23
 
| 23
 
| 0x00080000
 
| 0x00080000
−
| VXF_VIRT_LOAD
+
| VIRT_LOAD
 
|
 
|
−
Virtualize load average information
+
| Virtualize load average information
 
|-
 
|-
 
| 24
 
| 24
 
| 0x00100000
 
| 0x00100000
−
| VXF_VIRT_TIME
+
| VIRT_TIME
 
|
 
|
−
Allow per guest time offsets
+
| Allow per guest time offsets
 
|-
 
|-
 
| 28
 
| 28
 
| 0x01000000
 
| 0x01000000
−
| VXF_HIDE_MOUNT
+
| HIDE_MOUNT
 
|
 
|
−
Hide entries in /proc/$pid/mounts
+
| Hide entries in /proc/$pid/mounts
 
|-
 
|-
 
| 29
 
| 29
 
| 0x02000000
 
| 0x02000000
−
| VXF_HIDE_NETIF
+
| HIDE_NETIF
 
|
 
|
−
Hide foreign network interfaces
+
| Hide foreign network interfaces
 
|-
 
|-
 
| 30
 
| 30
 
| 0x04000000
 
| 0x04000000
−
| VXF_HIDE_VINFO
+
| HIDE_VINFO
 
|
 
|
−
Hide context information in task status
+
| Hide context information in task status
 
|-
 
|-
 
| 32
 
| 32
 
| (1ULL<<32)
 
| (1ULL<<32)
−
| VXF_STATE_SETUP
+
| STATE_SETUP
−
|
+
| IO
−
Enable setup state
+
| Enable setup state
 
|-
 
|-
 
| 33
 
| 33
 
| (1ULL<<33)
 
| (1ULL<<33)
−
| VXF_STATE_INIT
+
| STATE_INIT
−
|
+
| IO
−
Enable init state
+
| Enable init state
 
|-
 
|-
 
| 34
 
| 34
 
| (1ULL<<34)
 
| (1ULL<<34)
−
| VXF_STATE_ADMIN
+
| STATE_ADMIN
−
|
+
| O
−
Enable admin state
+
| Enable admin state
 
|-
 
|-
 
| 36
 
| 36
 
| (1ULL<<36)
 
| (1ULL<<36)
−
| VXF_SC_HELPER
+
| SC_HELPER
−
|
+
| I
−
Enable state change helper
+
| Enable state change helper
 
|-
 
|-
 
| 37
 
| 37
 
| (1ULL<<37)
 
| (1ULL<<37)
−
| VXF_REBOOT_KILL
+
| REBOOT_KILL
 
|
 
|
−
Kill all processes on reboot(2)
+
| Kill all processes on reboot(2)
 
|-
 
|-
 
| 38
 
| 38
 
| (1ULL<<38)
 
| (1ULL<<38)
−
| VXF_PERSISTENT
+
| PERSISTENT
 
|
 
|
−
Make context persistent
+
| Make context persistent
 
|-
 
|-
 
| 0
 
| 0
 
| (1ULL<<48)
 
| (1ULL<<48)
−
| VXF_FORK_RSS
+
| FORK_RSS
 
|
 
|
−
Block fork when RSS limit is exceeded
+
| Block fork when RSS limit is exceeded
 
|-
 
|-
 
| 0
 
| 0
 
| (1ULL<<49)
 
| (1ULL<<49)
−
| VXF_PROLIFIC
+
| PROLIFIC
 
|
 
|
−
Allow context to create new contexts
+
| Allow context to create new contexts
 
|-
 
|-
 
| 0
 
| 0
 
| (1ULL<<52)
 
| (1ULL<<52)
−
| VXF_IGNEG_NICE
+
| IGNEG_NICE
 
|
 
|
−
Ignore priority raise
+
| Ignore priority raise
 
|}
 
|}
  
Line 573: Line 290:
 
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.
 
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.
  
−
{| class="wikitable"
+
{| class="wikitable_list"
 
! Bit
 
! Bit
 
! Mask
 
! Mask
 
! Name
 
! Name
 +
! Tag
 
! Description
 
! Description
 
|-
 
|-
 
| 0
 
| 0
 
| 0x00000001
 
| 0x00000001
−
| NXF_INFO_LOCK
+
| INFO_LOCK
 
|
 
|
−
Prohibit further context migration
+
| Prohibit further context migration
 +
|-
 +
| 8
 +
| 0x00000100
 +
| SINGLE_IP
 +
|
 +
| Enable special handling of network contexts with a single IP only
 +
|-
 +
| 29
 +
| 0x02000000
 +
| HIDE_NETIF
 +
|
 +
| Hide foreign network interfaces
 
|-
 
|-
 
| 32
 
| 32
 
| (1ULL<<32)
 
| (1ULL<<32)
−
| NXF_STATE_SETUP
+
| STATE_SETUP
−
|
+
| OI
−
Enable setup state
+
| Enable setup state
 
|-
 
|-
 
| 34
 
| 34
 
| (1ULL<<34)
 
| (1ULL<<34)
−
| NXF_STATE_ADMIN
+
| STATE_ADMIN
−
|
+
| O
−
Enable admin state
+
| Enable admin state
 
|-
 
|-
 
| 36
 
| 36
 
| (1ULL<<36)
 
| (1ULL<<36)
−
| NXF_SC_HELPER
+
| SC_HELPER
−
|
+
| I
−
Enable state change helper
+
| Enable state change helper
 
|-
 
|-
 
| 38
 
| 38
 
| (1ULL<<38)
 
| (1ULL<<38)
−
| NXF_PERSISTENT
+
| PERSISTENT
 +
|
 +
| Make network context persistent
 +
|}
 +
 
 +
== System capabilities (bcaps) ==
 +
 
 +
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.
 +
 
 +
{| class="wikitable_list"
 +
! Bit
 +
! Mask
 +
! Name
 +
! Description
 +
|-
 +
| 0
 +
| 0x00000001
 +
| CHOWN
 +
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
 +
|-
 +
| 1
 +
| 0x00000002
 +
| DAC_OVERRIDE
 +
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
 +
|-
 +
| 2
 +
| 0x00000004
 +
| DAC_READ_SEARCH
 +
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
 +
|-
 +
| 3
 +
| 0x00000008
 +
| FOWNER
 +
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
 +
|-
 +
| 4
 +
| 0x00000010
 +
| FSETID
 +
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
 +
|-
 +
| 5
 +
| 0x00000020
 +
| KILL
 +
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
 +
|-
 +
| 6
 +
| 0x00000040
 +
| SETGID
 +
|
 +
* Allows setgid(2) manipulation
 +
* Allows setgroups(2)
 +
* Allows forged gids on socket credentials passing.
 +
|-
 +
| 7
 +
| 0x00000080
 +
| SETUID
 
|
 
|
−
Make network context persistent
+
* Allows set*uid(2) manipulation (including fsuid).
 +
* Allows forged pids on socket credentials passing.
 +
|-
 +
| 8
 +
| 0x00000100
 +
| SETPCAP
 +
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
 +
|-
 +
| 9
 +
| 0x00000200
 +
| LINUX_IMMUTABLE
 +
| Allow modification of S_IMMUTABLE and S_APPEND file attributes
 +
|-
 +
| 10
 +
| 0x00000400
 +
| NET_BIND_SERVICE
 +
|
 +
* Allows binding to TCP/UDP sockets below 1024
 +
* Allows binding to ATM VCIs below 32
 +
|-
 +
| 11
 +
| 0x00000800
 +
| NET_BROADCAST
 +
| Allow broadcasting, listen to multicast
 +
|-
 +
| 12
 +
| 0x00001000
 +
| NET_ADMIN
 +
|
 +
* Allow interface configuration
 +
* Allow administration of IP firewall, masquerading and accounting
 +
* Allow setting debug option on sockets
 +
* Allow modification of routing tables
 +
* Allow setting arbitrary process / process group ownership on sockets
 +
* Allow binding to any address for transparent proxying
 +
* Allow setting TOS (type of service)
 +
* Allow setting promiscuous mode
 +
* Allow clearing driver statistics
 +
* Allow multicasting
 +
* Allow read/write of device-specific registers
 +
* Allow activation of ATM control sockets
 +
|-
 +
| 13
 +
| 0x00002000
 +
| NET_RAW
 +
|
 +
* Allow use of RAW sockets
 +
* Allow use of PACKET sockets
 +
|-
 +
| 14
 +
| 0x00004000
 +
| IPC_LOCK
 +
|
 +
* Allow locking of shared memory segments
 +
* Allow mlock and mlockall (which doesn't really have anything to do with IPC)
 +
|-
 +
| 15
 +
| 0x00008000
 +
| IPC_OWNER
 +
| Override IPC ownership checks
 +
|-
 +
| 16
 +
| 0x00010000
 +
| SYS_MODULE
 +
|
 +
* Insert and remove kernel modules - modify kernel without limit
 +
* Modify cap_bset
 +
|-
 +
| 17
 +
| 0x00020000
 +
| SYS_RAWIO
 +
|
 +
* Allow ioperm/iopl access
 +
* Allow sending USB messages to any device via /proc/bus/usb
 +
|-
 +
| 18
 +
| 0x00040000
 +
| SYS_CHROOT
 +
| * Allow use of chroot()
 +
|-
 +
| 19
 +
| 0x00080000
 +
| SYS_PTRACE
 +
| Allow ptrace() of any process
 +
|-
 +
| 20
 +
| 0x00100000
 +
| SYS_PACCT
 +
| Allow configuration of process accounting
 +
|-
 +
| 21
 +
| 0x00200000
 +
| SYS_ADMIN
 +
|
 +
* Allow configuration of the secure attention key
 +
* Allow administration of the random device
 +
* Allow examination and configuration of disk quotas
 +
* Allow configuring the kernel's syslog (printk behaviour)
 +
* Allow setting the domainname
 +
* Allow setting the hostname
 +
* Allow calling bdflush()
 +
* Allow mount() and umount(), setting up new smb connection
 +
* Allow some autofs root ioctls
 +
* Allow nfsservctl
 +
* Allow VM86_REQUEST_IRQ
 +
* Allow to read/write pci config on alpha
 +
* Allow irix_prctl on mips (setstacksize)
 +
* Allow flushing all cache on m68k (sys_cacheflush)
 +
* Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory)
 +
* Allow locking/unlocking of shared memory segment
 +
* Allow turning swap on/off
 +
* Allow forged pids on socket credentials passing
 +
* Allow setting readahead and flushing buffers on block devices
 +
* Allow setting geometry in floppy driver
 +
* Allow turning DMA on/off in xd driver
 +
* Allow administration of md devices (mostly the above, but some extra ioctls)
 +
* Allow tuning the ide driver
 +
* Allow access to the nvram device
 +
* Allow administration of apm_bios, serial and bttv (TV) device
 +
* Allow manufacturer commands in isdn CAPI support driver
 +
* Allow reading non-standardized portions of pci configuration space
 +
* Allow DDI debug ioctl on sbpcd driver
 +
* Allow setting up serial ports
 +
* Allow sending raw qic-117 commands
 +
* Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands
 +
* Allow setting encryption key on loopback filesystem
 +
* Allow setting zone reclaim policy
 +
|-
 +
| 22
 +
| 0x00400000
 +
| SYS_BOOT
 +
| Allow use of reboot()
 +
|-
 +
| 23
 +
| 0x00800000
 +
| SYS_NICE
 +
|
 +
* Allow raising priority and setting priority on other (different UID) processes
 +
* Allow use of FIFO and round-robin (realtime) scheduling on own processes and setting the scheduling algorithm used by another process.
 +
* Allow setting cpu affinity on other processes
 +
|-
 +
| 24
 +
| 0x01000000
 +
| SYS_RESOURCE
 +
|
 +
* Override resource limits. Set resource limits.
 +
* Override quota limits.
 +
* Override reserved space on ext2 filesystem
 +
* Modify data journaling mode on ext3 filesystem (uses journaling resources)
 +
* ''NOTE:'' ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too
 +
* Override size restrictions on IPC message queues
 +
* Allow more than 64hz interrupts from the real-time clock
 +
* Override max number of consoles on console allocation
 +
* Override max number of keymaps
 +
|-
 +
| 25
 +
| 0x02000000
 +
| SYS_TIME
 +
|
 +
* Allow manipulation of system clock
 +
* Allow irix_stime on mips
 +
* Allow setting the real-time clock
 +
|-
 +
| 26
 +
| 0x04000000
 +
| SYS_TTY_CONFIG
 +
|
 +
* Allow configuration of tty devices
 +
* Allow vhangup() of tty
 +
|-
 +
| 27
 +
| 0x08000000
 +
| MKNOD
 +
| Allow the privileged aspects of mknod()
 +
|-
 +
| 28
 +
| 0x10000000
 +
| LEASE
 +
| Allow taking of leases on files
 +
|-
 +
| 29
 +
| 0x20000000
 +
| AUDIT_WRITE
 +
| ??
 +
|-
 +
| 30
 +
| 0x40000000
 +
| AUDIT_CONTROL
 +
| ??
 
|}
 
|}

Revision as of 18:08, 22 October 2006


Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:

Bit 
The bit number to enable the capability/flag
Mask 
The bit number in hexadecimal notation
Name 
Human readable identifier used in userspace utilities
Tag 
Special capability/flag code to denote special behaviour, legacy usage and others (see below)
Description 
Description of capability/flag effects

Special capability/flags codes

The tag column may contain one or more of the following tags:

Tag Description
I Internal use only
L Only supported with legacy enabled
O One time capability/flag
U Unsupported
X Slightly different meaning in legacy

Context capabilities (ccaps)

The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 SET_UTSNAME Allow setdomainname(2) and sethostname(2)
1 0x00000002 SET_RLIMIT Allow setrlimit(2)
8 0x00000100 RAW_ICMP Allow usage of raw ICMP sockets
12 0x00001000 SYSLOG Allow syslog(2)
16 0x00010000 SECURE_MOUNT Allow secure mount(2)
17 0x00020000 SECURE_REMOUNT Allow secure remount
18 0x00040000 BINARY_MOUNT Allow binary/network mounts
20 0x00100000 QUOTA_CTL Allow quota ioctls
21 0x00200000 ADMIN_MAPPER Allow access to device mapper
22 0x00400000 ADMIN_CLOOP Allow access to loop devices

Context flags (cflags)

The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 INFO_LOCK L Prohibit further context migration
1 0x00000002 INFO_SCHED L Account all processes as one
2 0x00000004 INFO_NPROC L Apply process limits to context
3 0x00000008 INFO_PRIVATE L Context cannot be entered
4 0x00000010 INFO_INIT X Show a fake init process
5 0x00000020 INFO_HIDE X Hide context information in task status
6 0x00000040 INFO_ULIMIT L Apply ulimits to context
7 0x00000080 INFO_NSPACE L Use private namespace
8 0x00000100 SCHED_HARD Enable hard scheduler
9 0x00000200 SCHED_PRIO Enable priority scheduler
10 0x00000400 SCHED_PAUSE Pause context (unschedule)
20 0x00010000 VIRT_MEM Virtualize memory information
21 0x00020000 VIRT_UPTIME Virtualize uptime information
22 0x00040000 VIRT_CPU Virtualize cpu usage information
23 0x00080000 VIRT_LOAD Virtualize load average information
24 0x00100000 VIRT_TIME Allow per guest time offsets
28 0x01000000 HIDE_MOUNT Hide entries in /proc/$pid/mounts
29 0x02000000 HIDE_NETIF Hide foreign network interfaces
30 0x04000000 HIDE_VINFO Hide context information in task status
32 (1ULL<<32) STATE_SETUP IO Enable setup state
33 (1ULL<<33) STATE_INIT IO Enable init state
34 (1ULL<<34) STATE_ADMIN O Enable admin state
36 (1ULL<<36) SC_HELPER I Enable state change helper
37 (1ULL<<37) REBOOT_KILL Kill all processes on reboot(2)
38 (1ULL<<38) PERSISTENT Make context persistent
0 (1ULL<<48) FORK_RSS Block fork when RSS limit is exceeded
0 (1ULL<<49) PROLIFIC Allow context to create new contexts
0 (1ULL<<52) IGNEG_NICE Ignore priority raise


Network context flags (nflags)

The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 INFO_LOCK Prohibit further context migration
8 0x00000100 SINGLE_IP Enable special handling of network contexts with a single IP only
29 0x02000000 HIDE_NETIF Hide foreign network interfaces
32 (1ULL<<32) STATE_SETUP OI Enable setup state
34 (1ULL<<34) STATE_ADMIN O Enable admin state
36 (1ULL<<36) SC_HELPER I Enable state change helper
38 (1ULL<<38) PERSISTENT Make network context persistent

System capabilities (bcaps)

The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.

Bit Mask Name Description
0 0x00000001 CHOWN In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
1 0x00000002 DAC_OVERRIDE Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
2 0x00000004 DAC_READ_SEARCH Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
3 0x00000008 FOWNER Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
4 0x00000010 FSETID Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
5 0x00000020 KILL Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
6 0x00000040 SETGID
  • Allows setgid(2) manipulation
  • Allows setgroups(2)
  • Allows forged gids on socket credentials passing.
7 0x00000080 SETUID
  • Allows set*uid(2) manipulation (including fsuid).
  • Allows forged pids on socket credentials passing.
8 0x00000100 SETPCAP Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
9 0x00000200 LINUX_IMMUTABLE Allow modification of S_IMMUTABLE and S_APPEND file attributes
10 0x00000400 NET_BIND_SERVICE
  • Allows binding to TCP/UDP sockets below 1024
  • Allows binding to ATM VCIs below 32
11 0x00000800 NET_BROADCAST Allow broadcasting, listen to multicast
12 0x00001000 NET_ADMIN
  • Allow interface configuration
  • Allow administration of IP firewall, masquerading and accounting
  • Allow setting debug option on sockets
  • Allow modification of routing tables
  • Allow setting arbitrary process / process group ownership on sockets
  • Allow binding to any address for transparent proxying
  • Allow setting TOS (type of service)
  • Allow setting promiscuous mode
  • Allow clearing driver statistics
  • Allow multicasting
  • Allow read/write of device-specific registers
  • Allow activation of ATM control sockets
13 0x00002000 NET_RAW
  • Allow use of RAW sockets
  • Allow use of PACKET sockets
14 0x00004000 IPC_LOCK
  • Allow locking of shared memory segments
  • Allow mlock and mlockall (which doesn't really have anything to do with IPC)
15 0x00008000 IPC_OWNER Override IPC ownership checks
16 0x00010000 SYS_MODULE
  • Insert and remove kernel modules - modify kernel without limit
  • Modify cap_bset
17 0x00020000 SYS_RAWIO
  • Allow ioperm/iopl access
  • Allow sending USB messages to any device via /proc/bus/usb
18 0x00040000 SYS_CHROOT * Allow use of chroot()
19 0x00080000 SYS_PTRACE Allow ptrace() of any process
20 0x00100000 SYS_PACCT Allow configuration of process accounting
21 0x00200000 SYS_ADMIN
  • Allow configuration of the secure attention key
  • Allow administration of the random device
  • Allow examination and configuration of disk quotas
  • Allow configuring the kernel's syslog (printk behaviour)
  • Allow setting the domainname
  • Allow setting the hostname
  • Allow calling bdflush()
  • Allow mount() and umount(), setting up new smb connection
  • Allow some autofs root ioctls
  • Allow nfsservctl
  • Allow VM86_REQUEST_IRQ
  • Allow to read/write pci config on alpha
  • Allow irix_prctl on mips (setstacksize)
  • Allow flushing all cache on m68k (sys_cacheflush)
  • Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory)
  • Allow locking/unlocking of shared memory segment
  • Allow turning swap on/off
  • Allow forged pids on socket credentials passing
  • Allow setting readahead and flushing buffers on block devices
  • Allow setting geometry in floppy driver
  • Allow turning DMA on/off in xd driver
  • Allow administration of md devices (mostly the above, but some extra ioctls)
  • Allow tuning the ide driver
  • Allow access to the nvram device
  • Allow administration of apm_bios, serial and bttv (TV) device
  • Allow manufacturer commands in isdn CAPI support driver
  • Allow reading non-standardized portions of pci configuration space
  • Allow DDI debug ioctl on sbpcd driver
  • Allow setting up serial ports
  • Allow sending raw qic-117 commands
  • Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands
  • Allow setting encryption key on loopback filesystem
  • Allow setting zone reclaim policy
22 0x00400000 SYS_BOOT Allow use of reboot()
23 0x00800000 SYS_NICE
  • Allow raising priority and setting priority on other (different UID) processes
  • Allow use of FIFO and round-robin (realtime) scheduling on own processes and setting the scheduling algorithm used by another process.
  • Allow setting cpu affinity on other processes
24 0x01000000 SYS_RESOURCE
  • Override resource limits. Set resource limits.
  • Override quota limits.
  • Override reserved space on ext2 filesystem
  • Modify data journaling mode on ext3 filesystem (uses journaling resources)
  • NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too
  • Override size restrictions on IPC message queues
  • Allow more than 64hz interrupts from the real-time clock
  • Override max number of consoles on console allocation
  • Override max number of keymaps
25 0x02000000 SYS_TIME
  • Allow manipulation of system clock
  • Allow irix_stime on mips
  • Allow setting the real-time clock
26 0x04000000 SYS_TTY_CONFIG
  • Allow configuration of tty devices
  • Allow vhangup() of tty
27 0x08000000 MKNOD Allow the privileged aspects of mknod()
28 0x10000000 LEASE Allow taking of leases on files
29 0x20000000 AUDIT_WRITE  ??
30 0x40000000 AUDIT_CONTROL  ??
Retrieved from "http://linux-vserver.org/index.php?title=Capabilities_and_Flags&oldid=1807"
Personal tools