Difference between revisions of "Capabilities and Flags"

From Linux-VServer

Jump to: navigation, search
Line 44: Line 44:
 
! Description
 
! Description
 
|-
 
|-
−
| 0
+
| style="text-align: right" | 0
−
| 0x00000001
+
| style="font-family: monospace" | 0x00000001
 
| SET_UTSNAME
 
| SET_UTSNAME
 
|
 
|
 
| Allow setdomainname(2) and sethostname(2)
 
| Allow setdomainname(2) and sethostname(2)
 
|-
 
|-
−
| 1
+
| style="text-align: right" | 1
−
| 0x00000002
+
| style="font-family: monospace" | 0x00000002
 
| SET_RLIMIT
 
| SET_RLIMIT
 
|
 
|
 
| Allow setrlimit(2)
 
| Allow setrlimit(2)
 
|-
 
|-
−
| 8
+
| style="text-align: right" | 8
−
| 0x00000100
+
| style="font-family: monospace" | 0x00000100
 
| RAW_ICMP
 
| RAW_ICMP
 
|
 
|
 
| Allow usage of raw ICMP sockets
 
| Allow usage of raw ICMP sockets
 
|-
 
|-
−
| 12
+
| style="text-align: right" | 12
−
| 0x00001000
+
| style="font-family: monospace" | 0x00001000
 
| SYSLOG
 
| SYSLOG
 
|
 
|
 
| Allow syslog(2)
 
| Allow syslog(2)
 
|-
 
|-
−
| 16
+
| style="text-align: right" | 16
−
| 0x00010000
+
| style="font-family: monospace" | 0x00010000
 
| SECURE_MOUNT
 
| SECURE_MOUNT
 
|
 
|
 
| Allow secure mount(2)
 
| Allow secure mount(2)
 
|-
 
|-
−
| 17
+
| style="text-align: right" | 17
−
| 0x00020000
+
| style="font-family: monospace" | 0x00020000
 
| SECURE_REMOUNT
 
| SECURE_REMOUNT
 
|
 
|
 
| Allow secure remount
 
| Allow secure remount
 
|-
 
|-
−
| 18
+
| style="text-align: right" | 18
−
| 0x00040000
+
| style="font-family: monospace" | 0x00040000
 
| BINARY_MOUNT
 
| BINARY_MOUNT
 
|
 
|
 
| Allow binary/network mounts
 
| Allow binary/network mounts
 
|-
 
|-
−
| 20
+
| style="text-align: right" | 20
−
| 0x00100000
+
| style="font-family: monospace" | 0x00100000
 
| QUOTA_CTL
 
| QUOTA_CTL
 
|
 
|
 
| Allow quota ioctls
 
| Allow quota ioctls
 
|-
 
|-
−
| 21
+
| style="text-align: right" | 21
−
| 0x00200000
+
| style="font-family: monospace" | 0x00200000
 
| ADMIN_MAPPER
 
| ADMIN_MAPPER
 
|
 
|
 
| Allow access to device mapper
 
| Allow access to device mapper
 
|-
 
|-
−
| 22
+
| style="text-align: right" | 22
−
| 0x00400000
+
| style="font-family: monospace" | 0x00400000
 
| ADMIN_CLOOP
 
| ADMIN_CLOOP
 
|
 
|
Line 116: Line 116:
 
! Description
 
! Description
 
|-
 
|-
−
| 0
+
| style="text-align: right" | 0
−
| 0x00000001
+
| style="font-family: monospace" | 0x00000001
 
| INFO_LOCK
 
| INFO_LOCK
 
| L
 
| L
 
| Prohibit further context migration
 
| Prohibit further context migration
 
|-
 
|-
−
| 1
+
| style="text-align: right" | 1
−
| 0x00000002
+
| style="font-family: monospace" | 0x00000002
 
| INFO_SCHED
 
| INFO_SCHED
 
| L
 
| L
 
| Account all processes as one
 
| Account all processes as one
 
|-
 
|-
−
| 2
+
| style="text-align: right" | 2
−
| 0x00000004
+
| style="font-family: monospace" | 0x00000004
 
| INFO_NPROC
 
| INFO_NPROC
 
| L
 
| L
 
| Apply process limits to context
 
| Apply process limits to context
 
|-
 
|-
−
| 3
+
| style="text-align: right" | 3
−
| 0x00000008
+
| style="font-family: monospace" | 0x00000008
 
| INFO_PRIVATE
 
| INFO_PRIVATE
 
| L
 
| L
 
| Context cannot be entered
 
| Context cannot be entered
 
|-
 
|-
−
| 4
+
| style="text-align: right" | 4
−
| 0x00000010
+
| style="font-family: monospace" | 0x00000010
 
| INFO_INIT
 
| INFO_INIT
 
| X
 
| X
 
| Show a fake init process
 
| Show a fake init process
 
|-
 
|-
−
| 5
+
| style="text-align: right" | 5
−
| 0x00000020
+
| style="font-family: monospace" | 0x00000020
 
| INFO_HIDE
 
| INFO_HIDE
 
| X
 
| X
 
| Hide context information in task status
 
| Hide context information in task status
 
|-
 
|-
−
| 6
+
| style="text-align: right" | 6
−
| 0x00000040
+
| style="font-family: monospace" | 0x00000040
 
| INFO_ULIMIT
 
| INFO_ULIMIT
 
| L
 
| L
 
| Apply ulimits to context
 
| Apply ulimits to context
 
|-
 
|-
−
| 7
+
| style="text-align: right" | 7
−
| 0x00000080
+
| style="font-family: monospace" | 0x00000080
 
| INFO_NSPACE
 
| INFO_NSPACE
 
| L
 
| L
 
| Use private namespace
 
| Use private namespace
 
|-
 
|-
−
| 8
+
| style="text-align: right" | 8
−
| 0x00000100
+
| style="font-family: monospace" | 0x00000100
 
| SCHED_HARD
 
| SCHED_HARD
 
|
 
|
 
| Enable hard scheduler
 
| Enable hard scheduler
 
|-
 
|-
−
| 9
+
| style="text-align: right" | 9
−
| 0x00000200
+
| style="font-family: monospace" | 0x00000200
 
| SCHED_PRIO
 
| SCHED_PRIO
 
|
 
|
 
| Enable priority scheduler
 
| Enable priority scheduler
 
|-
 
|-
−
| 10
+
| style="text-align: right" | 10
−
| 0x00000400
+
| style="font-family: monospace" | 0x00000400
 
| SCHED_PAUSE
 
| SCHED_PAUSE
 
|
 
|
 
| Pause context (unschedule)
 
| Pause context (unschedule)
 
|-
 
|-
−
| 20
+
| style="text-align: right" | 20
−
| 0x00010000
+
| style="font-family: monospace" | 0x00010000
 
| VIRT_MEM
 
| VIRT_MEM
 
|
 
|
 
| Virtualize memory information
 
| Virtualize memory information
 
|-
 
|-
−
| 21
+
| style="text-align: right" | 21
−
| 0x00020000
+
| style="font-family: monospace" | 0x00020000
 
| VIRT_UPTIME
 
| VIRT_UPTIME
 
|
 
|
 
| Virtualize uptime information
 
| Virtualize uptime information
 
|-
 
|-
−
| 22
+
| style="text-align: right" | 22
−
| 0x00040000
+
| style="font-family: monospace" | 0x00040000
 
| VIRT_CPU
 
| VIRT_CPU
 
|
 
|
 
| Virtualize cpu usage information
 
| Virtualize cpu usage information
 
|-
 
|-
−
| 23
+
| style="text-align: right" | 23
−
| 0x00080000
+
| style="font-family: monospace" | 0x00080000
 
| VIRT_LOAD
 
| VIRT_LOAD
 
|
 
|
 
| Virtualize load average information
 
| Virtualize load average information
 
|-
 
|-
−
| 24
+
| style="text-align: right" | 24
−
| 0x00100000
+
| style="font-family: monospace" | 0x00100000
 
| VIRT_TIME
 
| VIRT_TIME
 
|
 
|
 
| Allow per guest time offsets
 
| Allow per guest time offsets
 
|-
 
|-
−
| 28
+
| style="text-align: right" | 28
−
| 0x01000000
+
| style="font-family: monospace" | 0x01000000
 
| HIDE_MOUNT
 
| HIDE_MOUNT
 
|
 
|
 
| Hide entries in /proc/$pid/mounts
 
| Hide entries in /proc/$pid/mounts
 
|-
 
|-
−
| 29
+
| style="text-align: right" | 29
−
| 0x02000000
+
| style="font-family: monospace" | 0x02000000
 
| HIDE_NETIF
 
| HIDE_NETIF
 
|
 
|
 
| Hide foreign network interfaces
 
| Hide foreign network interfaces
 
|-
 
|-
−
| 30
+
| style="text-align: right" | 30
−
| 0x04000000
+
| style="font-family: monospace" | 0x04000000
 
| HIDE_VINFO
 
| HIDE_VINFO
 
|
 
|
 
| Hide context information in task status
 
| Hide context information in task status
 
|-
 
|-
−
| 32
+
| style="text-align: right" | 32
−
| (1ULL<<32)
+
| style="font-family: monospace" | 0x0001<<32
 
| STATE_SETUP
 
| STATE_SETUP
 
| IO
 
| IO
 
| Enable setup state
 
| Enable setup state
 
|-
 
|-
−
| 33
+
| style="text-align: right" | 33
−
| (1ULL<<33)
+
| style="font-family: monospace" | 0x0001<<33
 
| STATE_INIT
 
| STATE_INIT
 
| IO
 
| IO
 
| Enable init state
 
| Enable init state
 
|-
 
|-
−
| 34
+
| style="text-align: right" | 34
−
| (1ULL<<34)
+
| style="font-family: monospace" | 0x0001<<34
 
| STATE_ADMIN
 
| STATE_ADMIN
 
| O
 
| O
 
| Enable admin state
 
| Enable admin state
 
|-
 
|-
−
| 36
+
| style="text-align: right" | 36
−
| (1ULL<<36)
+
| style="font-family: monospace" | 0x0001<<36
 
| SC_HELPER
 
| SC_HELPER
 
| I
 
| I
 
| Enable state change helper
 
| Enable state change helper
 
|-
 
|-
−
| 37
+
| style="text-align: right" | 37
−
| (1ULL<<37)
+
| style="font-family: monospace" | 0x0001<<37
 
| REBOOT_KILL
 
| REBOOT_KILL
 
|
 
|
 
| Kill all processes on reboot(2)
 
| Kill all processes on reboot(2)
 
|-
 
|-
−
| 38
+
| style="text-align: right" | 38
−
| (1ULL<<38)
+
| style="font-family: monospace" | 0x0001<<38
 
| PERSISTENT
 
| PERSISTENT
 
|
 
|
 
| Make context persistent
 
| Make context persistent
 
|-
 
|-
−
| 0
+
| style="text-align: right" | 48
−
| (1ULL<<48)
+
| style="font-family: monospace" | 0x0001<<48
 
| FORK_RSS
 
| FORK_RSS
 
|
 
|
 
| Block fork when RSS limit is exceeded
 
| Block fork when RSS limit is exceeded
 
|-
 
|-
−
| 0
+
| style="text-align: right" | 49
−
| (1ULL<<49)
+
| style="font-family: monospace" | 0x0001<<49
 
| PROLIFIC
 
| PROLIFIC
 
|
 
|
 
| Allow context to create new contexts
 
| Allow context to create new contexts
 
|-
 
|-
−
| 0
+
| style="text-align: right" | 52
−
| (1ULL<<52)
+
| style="font-family: monospace" | 0x0001<<52
 
| IGNEG_NICE
 
| IGNEG_NICE
 
|
 
|
Line 297: Line 297:
 
! Description
 
! Description
 
|-
 
|-
−
| 0
+
| style="text-align: right" | 0
−
| 0x00000001
+
| style="font-family: monospace" | 0x00000001
 
| INFO_LOCK
 
| INFO_LOCK
 
|
 
|
 
| Prohibit further context migration
 
| Prohibit further context migration
 
|-
 
|-
−
| 8
+
| style="text-align: right" | 8
−
| 0x00000100
+
| style="font-family: monospace" | 0x00000100
 
| SINGLE_IP
 
| SINGLE_IP
 
|
 
|
 
| Enable special handling of network contexts with a single IP only
 
| Enable special handling of network contexts with a single IP only
 
|-
 
|-
−
| 29
+
| style="text-align: right" | 29
−
| 0x02000000
+
| style="font-family: monospace" | 0x02000000
 
| HIDE_NETIF
 
| HIDE_NETIF
 
|
 
|
 
| Hide foreign network interfaces
 
| Hide foreign network interfaces
 
|-
 
|-
−
| 32
+
| style="text-align: right" | 32
−
| (1ULL<<32)
+
| style="font-family: monospace" | 0x0001<<32
 
| STATE_SETUP
 
| STATE_SETUP
−
| OI
+
| IO
 
| Enable setup state
 
| Enable setup state
 
|-
 
|-
−
| 34
+
| style="text-align: right" | 34
−
| (1ULL<<34)
+
| style="font-family: monospace" | 0x0001<<34
 
| STATE_ADMIN
 
| STATE_ADMIN
 
| O
 
| O
 
| Enable admin state
 
| Enable admin state
 
|-
 
|-
−
| 36
+
| style="text-align: right" | 36
−
| (1ULL<<36)
+
| style="font-family: monospace" | 0x0001<<36
 
| SC_HELPER
 
| SC_HELPER
 
| I
 
| I
 
| Enable state change helper
 
| Enable state change helper
 
|-
 
|-
−
| 38
+
| style="text-align: right" | 38
−
| (1ULL<<38)
+
| style="font-family: monospace" | 0x0001<<38
 
| PERSISTENT
 
| PERSISTENT
 
|
 
|
Line 350: Line 350:
 
! Description
 
! Description
 
|-
 
|-
−
| 0
+
| style="text-align: right" | 0
−
| 0x00000001
+
| style="font-family: monospace" | 0x00000001
 
| CHOWN
 
| CHOWN
 
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
 
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
 
|-
 
|-
−
| 1
+
| style="text-align: right" | 1
−
| 0x00000002
+
| style="font-family: monospace" | 0x00000002
 
| DAC_OVERRIDE
 
| DAC_OVERRIDE
 
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
 
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
 
|-
 
|-
−
| 2
+
| style="text-align: right" | 2
−
| 0x00000004
+
| style="font-family: monospace" | 0x00000004
 
| DAC_READ_SEARCH
 
| DAC_READ_SEARCH
 
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
 
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
 
|-
 
|-
−
| 3
+
| style="text-align: right" | 3
−
| 0x00000008
+
| style="font-family: monospace" | 0x00000008
 
| FOWNER
 
| FOWNER
 
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
 
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
 
|-
 
|-
−
| 4
+
| style="text-align: right" | 4
−
| 0x00000010
+
| style="font-family: monospace" | 0x00000010
 
| FSETID
 
| FSETID
 
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
 
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
 
|-
 
|-
−
| 5
+
| style="text-align: right" | 5
−
| 0x00000020
+
| style="font-family: monospace" | 0x00000020
 
| KILL
 
| KILL
 
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
 
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
 
|-
 
|-
−
| 6
+
| style="text-align: right" | 6
−
| 0x00000040
+
| style="font-family: monospace" | 0x00000040
 
| SETGID
 
| SETGID
 
|
 
|
Line 388: Line 388:
 
* Allows forged gids on socket credentials passing.
 
* Allows forged gids on socket credentials passing.
 
|-
 
|-
−
| 7
+
| style="text-align: right" | 7
−
| 0x00000080
+
| style="font-family: monospace" | 0x00000080
 
| SETUID
 
| SETUID
 
|
 
|
Line 395: Line 395:
 
* Allows forged pids on socket credentials passing.
 
* Allows forged pids on socket credentials passing.
 
|-
 
|-
−
| 8
+
| style="text-align: right" | 8
−
| 0x00000100
+
| style="font-family: monospace" | 0x00000100
 
| SETPCAP
 
| SETPCAP
 
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
 
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
 
|-
 
|-
−
| 9
+
| style="text-align: right" | 9
−
| 0x00000200
+
| style="font-family: monospace" | 0x00000200
 
| LINUX_IMMUTABLE
 
| LINUX_IMMUTABLE
 
| Allow modification of S_IMMUTABLE and S_APPEND file attributes
 
| Allow modification of S_IMMUTABLE and S_APPEND file attributes
 
|-
 
|-
−
| 10
+
| style="text-align: right" | 10
−
| 0x00000400
+
| style="font-family: monospace" | 0x00000400
 
| NET_BIND_SERVICE
 
| NET_BIND_SERVICE
 
|
 
|
Line 412: Line 412:
 
* Allows binding to ATM VCIs below 32
 
* Allows binding to ATM VCIs below 32
 
|-
 
|-
−
| 11
+
| style="text-align: right" | 11
−
| 0x00000800
+
| style="font-family: monospace" | 0x00000800
 
| NET_BROADCAST
 
| NET_BROADCAST
 
| Allow broadcasting, listen to multicast
 
| Allow broadcasting, listen to multicast
 
|-
 
|-
−
| 12
+
| style="text-align: right" | 12
−
| 0x00001000
+
| style="font-family: monospace" | 0x00001000
 
| NET_ADMIN
 
| NET_ADMIN
 
|
 
|
Line 434: Line 434:
 
* Allow activation of ATM control sockets
 
* Allow activation of ATM control sockets
 
|-
 
|-
−
| 13
+
| style="text-align: right" | 13
−
| 0x00002000
+
| style="font-family: monospace" | 0x00002000
 
| NET_RAW
 
| NET_RAW
 
|
 
|
Line 441: Line 441:
 
* Allow use of PACKET sockets
 
* Allow use of PACKET sockets
 
|-
 
|-
−
| 14
+
| style="text-align: right" | 14
−
| 0x00004000
+
| style="font-family: monospace" | 0x00004000
 
| IPC_LOCK
 
| IPC_LOCK
 
|
 
|
Line 448: Line 448:
 
* Allow mlock and mlockall (which doesn't really have anything to do with IPC)
 
* Allow mlock and mlockall (which doesn't really have anything to do with IPC)
 
|-
 
|-
−
| 15
+
| style="text-align: right" | 15
−
| 0x00008000
+
| style="font-family: monospace" | 0x00008000
 
| IPC_OWNER
 
| IPC_OWNER
 
| Override IPC ownership checks
 
| Override IPC ownership checks
 
|-
 
|-
−
| 16
+
| style="text-align: right" | 16
−
| 0x00010000
+
| style="font-family: monospace" | 0x00010000
 
| SYS_MODULE
 
| SYS_MODULE
 
|
 
|
Line 460: Line 460:
 
* Modify cap_bset
 
* Modify cap_bset
 
|-
 
|-
−
| 17
+
| style="text-align: right" | 17
−
| 0x00020000
+
| style="font-family: monospace" | 0x00020000
 
| SYS_RAWIO
 
| SYS_RAWIO
 
|
 
|
Line 467: Line 467:
 
* Allow sending USB messages to any device via /proc/bus/usb
 
* Allow sending USB messages to any device via /proc/bus/usb
 
|-
 
|-
−
| 18
+
| style="text-align: right" | 18
−
| 0x00040000
+
| style="font-family: monospace" | 0x00040000
 
| SYS_CHROOT
 
| SYS_CHROOT
−
| * Allow use of chroot()
+
| Allow use of chroot()
 
|-
 
|-
−
| 19
+
| style="text-align: right" | 19
−
| 0x00080000
+
| style="font-family: monospace" | 0x00080000
 
| SYS_PTRACE
 
| SYS_PTRACE
 
| Allow ptrace() of any process
 
| Allow ptrace() of any process
 
|-
 
|-
−
| 20
+
| style="text-align: right" | 20
−
| 0x00100000
+
| style="font-family: monospace" | 0x00100000
 
| SYS_PACCT
 
| SYS_PACCT
 
| Allow configuration of process accounting
 
| Allow configuration of process accounting
 
|-
 
|-
−
| 21
+
| style="text-align: right" | 21
−
| 0x00200000
+
| style="font-family: monospace" | 0x00200000
 
| SYS_ADMIN
 
| SYS_ADMIN
 
|
 
|
Line 520: Line 520:
 
* Allow setting zone reclaim policy
 
* Allow setting zone reclaim policy
 
|-
 
|-
−
| 22
+
| style="text-align: right" | 22
−
| 0x00400000
+
| style="font-family: monospace" | 0x00400000
 
| SYS_BOOT
 
| SYS_BOOT
 
| Allow use of reboot()
 
| Allow use of reboot()
 
|-
 
|-
−
| 23
+
| style="text-align: right" | 23
−
| 0x00800000
+
| style="font-family: monospace" | 0x00800000
 
| SYS_NICE
 
| SYS_NICE
 
|
 
|
Line 533: Line 533:
 
* Allow setting cpu affinity on other processes
 
* Allow setting cpu affinity on other processes
 
|-
 
|-
−
| 24
+
| style="text-align: right" | 24
−
| 0x01000000
+
| style="font-family: monospace" | 0x01000000
 
| SYS_RESOURCE
 
| SYS_RESOURCE
 
|
 
|
Line 547: Line 547:
 
* Override max number of keymaps
 
* Override max number of keymaps
 
|-
 
|-
−
| 25
+
| style="text-align: right" | 25
−
| 0x02000000
+
| style="font-family: monospace" | 0x02000000
 
| SYS_TIME
 
| SYS_TIME
 
|
 
|
Line 555: Line 555:
 
* Allow setting the real-time clock
 
* Allow setting the real-time clock
 
|-
 
|-
−
| 26
+
| style="text-align: right" | 26
−
| 0x04000000
+
| style="font-family: monospace" | 0x04000000
 
| SYS_TTY_CONFIG
 
| SYS_TTY_CONFIG
 
|
 
|
Line 562: Line 562:
 
* Allow vhangup() of tty
 
* Allow vhangup() of tty
 
|-
 
|-
−
| 27
+
| style="text-align: right" | 27
−
| 0x08000000
+
| style="font-family: monospace" | 0x08000000
 
| MKNOD
 
| MKNOD
 
| Allow the privileged aspects of mknod()
 
| Allow the privileged aspects of mknod()
 
|-
 
|-
−
| 28
+
| style="text-align: right" | 28
−
| 0x10000000
+
| style="font-family: monospace" | 0x10000000
 
| LEASE
 
| LEASE
 
| Allow taking of leases on files
 
| Allow taking of leases on files
 
|-
 
|-
−
| 29
+
| style="text-align: right" | 29
−
| 0x20000000
+
| style="font-family: monospace" | 0x20000000
 
| AUDIT_WRITE
 
| AUDIT_WRITE
 
| ??
 
| ??
 
|-
 
|-
−
| 30
+
| style="text-align: right" | 30
−
| 0x40000000
+
| style="font-family: monospace" | 0x40000000
 
| AUDIT_CONTROL
 
| AUDIT_CONTROL
 
| ??
 
| ??
 
|}
 
|}

Revision as of 18:43, 22 October 2006


Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:

Bit 
The bit number to enable the capability/flag
Mask 
The bit number in hexadecimal notation
Name 
Human readable identifier used in userspace utilities
Tag 
Special capability/flag code to denote special behaviour, legacy usage and others (see below)
Description 
Description of capability/flag effects

Special capability/flags codes

The tag column may contain one or more of the following tags:

Tag Description
I Internal use only
L Only supported with legacy enabled
O One time capability/flag
U Unsupported
X Slightly different meaning in legacy

Context capabilities (ccaps)

The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 SET_UTSNAME Allow setdomainname(2) and sethostname(2)
1 0x00000002 SET_RLIMIT Allow setrlimit(2)
8 0x00000100 RAW_ICMP Allow usage of raw ICMP sockets
12 0x00001000 SYSLOG Allow syslog(2)
16 0x00010000 SECURE_MOUNT Allow secure mount(2)
17 0x00020000 SECURE_REMOUNT Allow secure remount
18 0x00040000 BINARY_MOUNT Allow binary/network mounts
20 0x00100000 QUOTA_CTL Allow quota ioctls
21 0x00200000 ADMIN_MAPPER Allow access to device mapper
22 0x00400000 ADMIN_CLOOP Allow access to loop devices

Context flags (cflags)

The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 INFO_LOCK L Prohibit further context migration
1 0x00000002 INFO_SCHED L Account all processes as one
2 0x00000004 INFO_NPROC L Apply process limits to context
3 0x00000008 INFO_PRIVATE L Context cannot be entered
4 0x00000010 INFO_INIT X Show a fake init process
5 0x00000020 INFO_HIDE X Hide context information in task status
6 0x00000040 INFO_ULIMIT L Apply ulimits to context
7 0x00000080 INFO_NSPACE L Use private namespace
8 0x00000100 SCHED_HARD Enable hard scheduler
9 0x00000200 SCHED_PRIO Enable priority scheduler
10 0x00000400 SCHED_PAUSE Pause context (unschedule)
20 0x00010000 VIRT_MEM Virtualize memory information
21 0x00020000 VIRT_UPTIME Virtualize uptime information
22 0x00040000 VIRT_CPU Virtualize cpu usage information
23 0x00080000 VIRT_LOAD Virtualize load average information
24 0x00100000 VIRT_TIME Allow per guest time offsets
28 0x01000000 HIDE_MOUNT Hide entries in /proc/$pid/mounts
29 0x02000000 HIDE_NETIF Hide foreign network interfaces
30 0x04000000 HIDE_VINFO Hide context information in task status
32 0x0001<<32 STATE_SETUP IO Enable setup state
33 0x0001<<33 STATE_INIT IO Enable init state
34 0x0001<<34 STATE_ADMIN O Enable admin state
36 0x0001<<36 SC_HELPER I Enable state change helper
37 0x0001<<37 REBOOT_KILL Kill all processes on reboot(2)
38 0x0001<<38 PERSISTENT Make context persistent
48 0x0001<<48 FORK_RSS Block fork when RSS limit is exceeded
49 0x0001<<49 PROLIFIC Allow context to create new contexts
52 0x0001<<52 IGNEG_NICE Ignore priority raise


Network context flags (nflags)

The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 INFO_LOCK Prohibit further context migration
8 0x00000100 SINGLE_IP Enable special handling of network contexts with a single IP only
29 0x02000000 HIDE_NETIF Hide foreign network interfaces
32 0x0001<<32 STATE_SETUP IO Enable setup state
34 0x0001<<34 STATE_ADMIN O Enable admin state
36 0x0001<<36 SC_HELPER I Enable state change helper
38 0x0001<<38 PERSISTENT Make network context persistent

System capabilities (bcaps)

The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.

Bit Mask Name Description
0 0x00000001 CHOWN In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
1 0x00000002 DAC_OVERRIDE Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
2 0x00000004 DAC_READ_SEARCH Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
3 0x00000008 FOWNER Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
4 0x00000010 FSETID Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
5 0x00000020 KILL Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
6 0x00000040 SETGID
  • Allows setgid(2) manipulation
  • Allows setgroups(2)
  • Allows forged gids on socket credentials passing.
7 0x00000080 SETUID
  • Allows set*uid(2) manipulation (including fsuid).
  • Allows forged pids on socket credentials passing.
8 0x00000100 SETPCAP Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
9 0x00000200 LINUX_IMMUTABLE Allow modification of S_IMMUTABLE and S_APPEND file attributes
10 0x00000400 NET_BIND_SERVICE
  • Allows binding to TCP/UDP sockets below 1024
  • Allows binding to ATM VCIs below 32
11 0x00000800 NET_BROADCAST Allow broadcasting, listen to multicast
12 0x00001000 NET_ADMIN
  • Allow interface configuration
  • Allow administration of IP firewall, masquerading and accounting
  • Allow setting debug option on sockets
  • Allow modification of routing tables
  • Allow setting arbitrary process / process group ownership on sockets
  • Allow binding to any address for transparent proxying
  • Allow setting TOS (type of service)
  • Allow setting promiscuous mode
  • Allow clearing driver statistics
  • Allow multicasting
  • Allow read/write of device-specific registers
  • Allow activation of ATM control sockets
13 0x00002000 NET_RAW
  • Allow use of RAW sockets
  • Allow use of PACKET sockets
14 0x00004000 IPC_LOCK
  • Allow locking of shared memory segments
  • Allow mlock and mlockall (which doesn't really have anything to do with IPC)
15 0x00008000 IPC_OWNER Override IPC ownership checks
16 0x00010000 SYS_MODULE
  • Insert and remove kernel modules - modify kernel without limit
  • Modify cap_bset
17 0x00020000 SYS_RAWIO
  • Allow ioperm/iopl access
  • Allow sending USB messages to any device via /proc/bus/usb
18 0x00040000 SYS_CHROOT Allow use of chroot()
19 0x00080000 SYS_PTRACE Allow ptrace() of any process
20 0x00100000 SYS_PACCT Allow configuration of process accounting
21 0x00200000 SYS_ADMIN
  • Allow configuration of the secure attention key
  • Allow administration of the random device
  • Allow examination and configuration of disk quotas
  • Allow configuring the kernel's syslog (printk behaviour)
  • Allow setting the domainname
  • Allow setting the hostname
  • Allow calling bdflush()
  • Allow mount() and umount(), setting up new smb connection
  • Allow some autofs root ioctls
  • Allow nfsservctl
  • Allow VM86_REQUEST_IRQ
  • Allow to read/write pci config on alpha
  • Allow irix_prctl on mips (setstacksize)
  • Allow flushing all cache on m68k (sys_cacheflush)
  • Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory)
  • Allow locking/unlocking of shared memory segment
  • Allow turning swap on/off
  • Allow forged pids on socket credentials passing
  • Allow setting readahead and flushing buffers on block devices
  • Allow setting geometry in floppy driver
  • Allow turning DMA on/off in xd driver
  • Allow administration of md devices (mostly the above, but some extra ioctls)
  • Allow tuning the ide driver
  • Allow access to the nvram device
  • Allow administration of apm_bios, serial and bttv (TV) device
  • Allow manufacturer commands in isdn CAPI support driver
  • Allow reading non-standardized portions of pci configuration space
  • Allow DDI debug ioctl on sbpcd driver
  • Allow setting up serial ports
  • Allow sending raw qic-117 commands
  • Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands
  • Allow setting encryption key on loopback filesystem
  • Allow setting zone reclaim policy
22 0x00400000 SYS_BOOT Allow use of reboot()
23 0x00800000 SYS_NICE
  • Allow raising priority and setting priority on other (different UID) processes
  • Allow use of FIFO and round-robin (realtime) scheduling on own processes and setting the scheduling algorithm used by another process.
  • Allow setting cpu affinity on other processes
24 0x01000000 SYS_RESOURCE
  • Override resource limits. Set resource limits.
  • Override quota limits.
  • Override reserved space on ext2 filesystem
  • Modify data journaling mode on ext3 filesystem (uses journaling resources)
  • NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too
  • Override size restrictions on IPC message queues
  • Allow more than 64hz interrupts from the real-time clock
  • Override max number of consoles on console allocation
  • Override max number of keymaps
25 0x02000000 SYS_TIME
  • Allow manipulation of system clock
  • Allow irix_stime on mips
  • Allow setting the real-time clock
26 0x04000000 SYS_TTY_CONFIG
  • Allow configuration of tty devices
  • Allow vhangup() of tty
27 0x08000000 MKNOD Allow the privileged aspects of mknod()
28 0x10000000 LEASE Allow taking of leases on files
29 0x20000000 AUDIT_WRITE  ??
30 0x40000000 AUDIT_CONTROL  ??
Retrieved from "http://linux-vserver.org/index.php?title=Capabilities_and_Flags&oldid=1809"
Personal tools