Capabilities and Flags: Difference between revisions

From Linix VServer
Jump to navigationJump to search
imported>Hollow
No edit summary
 
imported>Hollow
No edit summary
Line 1: Line 1:
Below is a list of capabilities and flags used for contexts and processes within.
__NOTOC__


== System capabilities (bcaps) ==
Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:


The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.
; Bit : The bit number to enable the capability/flag
; Mask : The bit number in hexadecimal notation
; Name : Human readable identifier used in userspace utilities
; Tag : Special capability/flag code to denote special behaviour, legacy usage and others (see below)
; Description : Description of capability/flag effects


{| class="wikitable"
== Special capability/flags codes ==
! Bit
! Mask
! Name
! Description
|-
| 0
| 0x00000001
| CAP_CHOWN
|
In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this
overrides the restriction of changing file ownership and group
ownership.


|-
The tag column may contain one or more of the following tags:
| 1
| 0x00000002
| CAP_DAC_OVERRIDE
|
Override all DAC access, including ACL execute access if
[_POSIX_ACL] is defined. Excluding DAC access covered by
CAP_LINUX_IMMUTABLE.
 
|-
| 2
| 0x00000004
| CAP_DAC_READ_SEARCH
|
Overrides all DAC restrictions regarding read and search on files
and directories, including ACL restrictions if [_POSIX_ACL] is
defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
 
|-
| 3
| 0x00000008
| CAP_FOWNER
|
Overrides all restrictions about allowed operations on files, where
file owner ID must be equal to the user ID, except where CAP_FSETID
is applicable. It doesn't override MAC and DAC restrictions.
 
|-
| 4
| 0x00000010
| CAP_FSETID
|
Overrides the following restrictions that the effective user ID
shall match the file owner ID when setting the S_ISUID and S_ISGID
bits on that file; that the effective group ID (or one of the
supplementary group IDs) shall match the file owner ID when setting
the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are
cleared on successful return from chown(2) (not implemented).
 
|-
| 5
| 0x00000020
| CAP_KILL
|
Overrides the restriction that the real or effective user ID of a
process sending a signal must match the real or effective user ID
of the process receiving the signal.
 
|-
| 6
| 0x00000040
| CAP_SETGID
|
Allows setgid(2) manipulation<br />
Allows setgroups(2)<br />
Allows forged gids on socket credentials passing.
 
|-
| 7
| 0x00000080
| CAP_SETUID
|
Allows set*uid(2) manipulation (including fsuid).<br />
Allows forged pids on socket credentials passing.
 
|-
| 8
| 0x00000100
| CAP_SETPCAP
|
Transfer any capability in your permitted set to any pid,
remove any capability in your permitted set from any pid
 
|-
| 9
| 0x00000200
| CAP_LINUX_IMMUTABLE
|
Allow modification of S_IMMUTABLE and S_APPEND file attributes
 
|-
| 10
| 0x00000400
| CAP_NET_BIND_SERVICE
|
Allows binding to TCP/UDP sockets below 1024<br />
Allows binding to ATM VCIs below 32
 
|-
| 11
| 0x00000800
| CAP_NET_BROADCAST
|
Allow broadcasting, listen to multicast
 
|-
| 12
| 0x00001000
| CAP_NET_ADMIN
|
Allow interface configuration<br />
Allow administration of IP firewall, masquerading and accounting<br />
Allow setting debug option on sockets<br />
Allow modification of routing tables<br />
Allow setting arbitrary process / process group ownership on
sockets<br />
Allow binding to any address for transparent proxying<br />
Allow setting TOS (type of service)<br />
Allow setting promiscuous mode<br />
Allow clearing driver statistics<br />
Allow multicasting<br />
Allow read/write of device-specific registers<br />
Allow activation of ATM control sockets
 
|-
| 13
| 0x00002000
| CAP_NET_RAW
|
Allow use of RAW sockets<br />
Allow use of PACKET sockets


{| class="wikitable_inline"
! Tag
! Description
|-
|-
| 14
| I
| 0x00004000
| Internal use only
| CAP_IPC_LOCK
|
Allow locking of shared memory segments<br />
Allow mlock and mlockall (which doesn't really have anything to do
with IPC)
 
|-
|-
| 15
| L
| 0x00008000
| Only supported with legacy enabled
| CAP_IPC_OWNER
|
Override IPC ownership checks
 
|-
|-
| 16
| O
| 0x00010000
| One time capability/flag
| CAP_SYS_MODULE
|
Insert and remove kernel modules - modify kernel without limit<br />
Modify cap_bset
 
|-
| 17
| 0x00020000
| CAP_SYS_RAWIO
|
Allow ioperm/iopl access<br />
Allow sending USB messages to any device via /proc/bus/usb
 
|-
| 18
| 0x00040000
| CAP_SYS_CHROOT
|
Allow use of chroot()
 
|-
| 19
| 0x00080000
| CAP_SYS_PTRACE
|
Allow ptrace() of any process
 
|-
| 20
| 0x00100000
| CAP_SYS_PACCT
|
Allow configuration of process accounting
 
|-
| 21
| 0x00200000
| CAP_SYS_ADMIN
|
Allow configuration of the secure attention key<br />
Allow administration of the random device<br />
Allow examination and configuration of disk quotas<br />
Allow configuring the kernel's syslog (printk behaviour)<br />
Allow setting the domainname<br />
Allow setting the hostname<br />
Allow calling bdflush()<br />
Allow mount() and umount(), setting up new smb connection<br />
Allow some autofs root ioctls<br />
Allow nfsservctl<br />
Allow VM86_REQUEST_IRQ<br />
Allow to read/write pci config on alpha<br />
Allow irix_prctl on mips (setstacksize)<br />
Allow flushing all cache on m68k (sys_cacheflush)<br />
Allow removing semaphores<br />
Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores
and shared memory<br />
Allow locking/unlocking of shared memory segment<br />
Allow turning swap on/off<br />
Allow forged pids on socket credentials passing<br />
Allow setting readahead and flushing buffers on block devices<br />
Allow setting geometry in floppy driver<br />
Allow turning DMA on/off in xd driver<br />
Allow administration of md devices (mostly the above, but some
extra ioctls)<br />
Allow tuning the ide driver<br />
Allow access to the nvram device<br />
Allow administration of apm_bios, serial and bttv (TV) device<br />
Allow manufacturer commands in isdn CAPI support driver<br />
Allow reading non-standardized portions of pci configuration space<br />
Allow DDI debug ioctl on sbpcd driver<br />
Allow setting up serial ports<br />
Allow sending raw qic-117 commands<br />
Allow enabling/disabling tagged queuing on SCSI controllers and sending
arbitrary SCSI commands<br />
Allow setting encryption key on loopback filesystem<br />
Allow setting zone reclaim policy
 
|-
| 22
| 0x00400000
| CAP_SYS_BOOT
|
Allow use of reboot()
 
|-
| 23
| 0x00800000
| CAP_SYS_NICE
|
Allow raising priority and setting priority on other (different
UID) processes<br />
Allow use of FIFO and round-robin (realtime) scheduling on own
processes and setting the scheduling algorithm used by another
process.<br />
Allow setting cpu affinity on other processes
 
|-
| 24
| 0x01000000
| CAP_SYS_RESOURCE
|
Override resource limits. Set resource limits.<br />
Override quota limits.<br />
Override reserved space on ext2 filesystem<br />
Modify data journaling mode on ext3 filesystem (uses journaling
resources)<br />
''NOTE:'' ext2 honors fsuid when checking for resource overrides, so
you can override using fsuid too<br />
Override size restrictions on IPC message queues<br />
Allow more than 64hz interrupts from the real-time clock<br />
Override max number of consoles on console allocation<br />
Override max number of keymaps
 
|-
| 25
| 0x02000000
| CAP_SYS_TIME
|
Allow manipulation of system clock<br />
Allow irix_stime on mips<br />
Allow setting the real-time clock
 
|-
| 26
| 0x04000000
| CAP_SYS_TTY_CONFIG
|
Allow configuration of tty devices<br />
Allow vhangup() of tty
 
|-
| 27
| 0x08000000
| CAP_MKNOD
|
Allow the privileged aspects of mknod()
 
|-
| 28
| 0x10000000
| CAP_LEASE
|
Allow taking of leases on files
 
|-
|-
| 29
| U
| 0x20000000
| Unsupported
| CAP_AUDIT_WRITE
|
??
|-
|-
| 30
| X
| 0x40000000
| Slightly different meaning in legacy
| CAP_AUDIT_CONTROL
|
??
|}
|}


Line 322: Line 37:
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.


{| class="wikitable"
{| class="wikitable_list"
! Bit
! Bit
! Mask
! Mask
! Name
! Name
! Tag
! Description
! Description
|-
|-
| 0
| 0
| 0x00000001
| 0x00000001
| VXC_SET_UTSNAME
| SET_UTSNAME
|
|
Allow setdomainname(2) and sethostname(2)
| Allow setdomainname(2) and sethostname(2)
|-
|-
| 1
| 1
| 0x00000002
| 0x00000002
| VXC_SET_RLIMIT
| SET_RLIMIT
|
|
Allow setrlimit(2)
| Allow setrlimit(2)
|-
|-
| 8
| 8
| 0x00000100
| 0x00000100
| VXC_RAW_ICMP
| RAW_ICMP
|
|
Allow usage of raw ICMP sockets
| Allow usage of raw ICMP sockets
|-
|-
| 12
| 12
| 0x00001000
| 0x00001000
| VXC_SYSLOG
| SYSLOG
|
|
Allow syslog(2)
| Allow syslog(2)
|-
|-
| 16
| 16
| 0x00010000
| 0x00010000
| VXC_SECURE_MOUNT
| SECURE_MOUNT
|
|
Allow secure mount(2)
| Allow secure mount(2)
|-
|-
| 17
| 17
| 0x00020000
| 0x00020000
| VXC_SECURE_REMOUNT
| SECURE_REMOUNT
|
|
Allow secure remount
| Allow secure remount
|-
|-
| 18
| 18
| 0x00040000
| 0x00040000
| VXC_BINARY_MOUNT
| BINARY_MOUNT
|
|
Allow binary/network mounts
| Allow binary/network mounts
|-
|-
| 20
| 20
| 0x00100000
| 0x00100000
| VXC_QUOTA_CTL
| QUOTA_CTL
|
|
Allow quota ioctls
| Allow quota ioctls
|-
|-
| 21
| 21
| 0x00200000
| 0x00200000
| VXC_ADMIN_MAPPER
| ADMIN_MAPPER
|
|
Allow access to device mapper
| Allow access to device mapper
|-
|-
| 22
| 22
| 0x00400000
| 0x00400000
| VXC_ADMIN_CLOOP
| ADMIN_CLOOP
|
|
Allow access to loop devices
| Allow access to loop devices
|}
|}


Line 393: Line 109:
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.


{| class="wikitable"
{| class="wikitable_list"
! Bit
! Bit
! Mask
! Mask
! Name
! Name
! Tag
! Description
! Description
|-
|-
| 0
| 0
| 0x00000001
| 0x00000001
| VXF_INFO_LOCK
| INFO_LOCK
|
| L
Prohibit further context migration
| Prohibit further context migration
|-
|-
| 1
| 1
| 0x00000002
| 0x00000002
| VXF_INFO_SCHED
| INFO_SCHED
|
| L
Account all processes as one (Legacy)
| Account all processes as one
|-
|-
| 2
| 2
| 0x00000004
| 0x00000004
| VXF_INFO_NPROC
| INFO_NPROC
|
| L
Apply process limits to context (Legacy)
| Apply process limits to context
|-
|-
| 3
| 3
| 0x00000008
| 0x00000008
| VXF_INFO_PRIVATE
| INFO_PRIVATE
|
| L
Context cannot be entered (Legacy)
| Context cannot be entered
|-
|-
| 4
| 4
| 0x00000010
| 0x00000010
| VXF_INFO_INIT
| INFO_INIT
|
| X
Show a fake init process
| Show a fake init process
|-
|-
| 5
| 5
| 0x00000020
| 0x00000020
| VXF_INFO_HIDE
| INFO_HIDE
|
| X
Hide context information in task status
| Hide context information in task status
|-
|-
| 6
| 6
| 0x00000040
| 0x00000040
| VXF_INFO_ULIMIT
| INFO_ULIMIT
|
| L
Apply ulimits to context (Legacy)
| Apply ulimits to context
|-
|-
| 7
| 7
| 0x00000080
| 0x00000080
| VXF_INFO_NSPACE
| INFO_NSPACE
|
| L
Use private namespace (Legacy)
| Use private namespace
|-
|-
| 8
| 8
| 0x00000100
| 0x00000100
| VXF_SCHED_HARD
| SCHED_HARD
|
|
Enable hard scheduler
| Enable hard scheduler
|-
|-
| 9
| 9
| 0x00000200
| 0x00000200
| VXF_SCHED_PRIO
| SCHED_PRIO
|
|
Enable priority scheduler
| Enable priority scheduler
|-
|-
| 10
| 10
| 0x00000400
| 0x00000400
| VXF_SCHED_PAUSE
| SCHED_PAUSE
|
|
Pause context (unschedule)
| Pause context (unschedule)
|-
|-
| 20
| 20
| 0x00010000
| 0x00010000
| VXF_VIRT_MEM
| VIRT_MEM
|
|
Virtualize memory information
| Virtualize memory information
|-
|-
| 21
| 21
| 0x00020000
| 0x00020000
| VXF_VIRT_UPTIME
| VIRT_UPTIME
|
|
Virtualize uptime information
| Virtualize uptime information
|-
|-
| 22
| 22
| 0x00040000
| 0x00040000
| VXF_VIRT_CPU
| VIRT_CPU
|
|
Virtualize cpu usage information
| Virtualize cpu usage information
|-
|-
| 23
| 23
| 0x00080000
| 0x00080000
| VXF_VIRT_LOAD
| VIRT_LOAD
|
|
Virtualize load average information
| Virtualize load average information
|-
|-
| 24
| 24
| 0x00100000
| 0x00100000
| VXF_VIRT_TIME
| VIRT_TIME
|
|
Allow per guest time offsets
| Allow per guest time offsets
|-
|-
| 28
| 28
| 0x01000000
| 0x01000000
| VXF_HIDE_MOUNT
| HIDE_MOUNT
|
|
Hide entries in /proc/$pid/mounts
| Hide entries in /proc/$pid/mounts
|-
|-
| 29
| 29
| 0x02000000
| 0x02000000
| VXF_HIDE_NETIF
| HIDE_NETIF
|
|
Hide foreign network interfaces
| Hide foreign network interfaces
|-
|-
| 30
| 30
| 0x04000000
| 0x04000000
| VXF_HIDE_VINFO
| HIDE_VINFO
|
|
Hide context information in task status
| Hide context information in task status
|-
|-
| 32
| 32
| (1ULL<<32)
| (1ULL<<32)
| VXF_STATE_SETUP
| STATE_SETUP
|
| IO
Enable setup state
| Enable setup state
|-
|-
| 33
| 33
| (1ULL<<33)
| (1ULL<<33)
| VXF_STATE_INIT
| STATE_INIT
|
| IO
Enable init state
| Enable init state
|-
|-
| 34
| 34
| (1ULL<<34)
| (1ULL<<34)
| VXF_STATE_ADMIN
| STATE_ADMIN
|
| O
Enable admin state
| Enable admin state
|-
|-
| 36
| 36
| (1ULL<<36)
| (1ULL<<36)
| VXF_SC_HELPER
| SC_HELPER
|
| I
Enable state change helper
| Enable state change helper
|-
|-
| 37
| 37
| (1ULL<<37)
| (1ULL<<37)
| VXF_REBOOT_KILL
| REBOOT_KILL
|
|
Kill all processes on reboot(2)
| Kill all processes on reboot(2)
|-
|-
| 38
| 38
| (1ULL<<38)
| (1ULL<<38)
| VXF_PERSISTENT
| PERSISTENT
|
|
Make context persistent
| Make context persistent
|-
|-
| 0
| 0
| (1ULL<<48)
| (1ULL<<48)
| VXF_FORK_RSS
| FORK_RSS
|
|
Block fork when RSS limit is exceeded
| Block fork when RSS limit is exceeded
|-
|-
| 0
| 0
| (1ULL<<49)
| (1ULL<<49)
| VXF_PROLIFIC
| PROLIFIC
|
|
Allow context to create new contexts
| Allow context to create new contexts
|-
|-
| 0
| 0
| (1ULL<<52)
| (1ULL<<52)
| VXF_IGNEG_NICE
| IGNEG_NICE
|
|
Ignore priority raise
| Ignore priority raise
|}
|}


Line 573: Line 290:
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.


{| class="wikitable"
{| class="wikitable_list"
! Bit
! Bit
! Mask
! Mask
! Name
! Name
! Tag
! Description
! Description
|-
|-
| 0
| 0
| 0x00000001
| 0x00000001
| NXF_INFO_LOCK
| INFO_LOCK
|
|
Prohibit further context migration
| Prohibit further context migration
|-
| 8
| 0x00000100
| SINGLE_IP
|
| Enable special handling of network contexts with a single IP only
|-
| 29
| 0x02000000
| HIDE_NETIF
|
| Hide foreign network interfaces
|-
|-
| 32
| 32
| (1ULL<<32)
| (1ULL<<32)
| NXF_STATE_SETUP
| STATE_SETUP
|
| OI
Enable setup state
| Enable setup state
|-
|-
| 34
| 34
| (1ULL<<34)
| (1ULL<<34)
| NXF_STATE_ADMIN
| STATE_ADMIN
|
| O
Enable admin state
| Enable admin state
|-
|-
| 36
| 36
| (1ULL<<36)
| (1ULL<<36)
| NXF_SC_HELPER
| SC_HELPER
|
| I
Enable state change helper
| Enable state change helper
|-
|-
| 38
| 38
| (1ULL<<38)
| (1ULL<<38)
| NXF_PERSISTENT
| PERSISTENT
|
| Make network context persistent
|}
 
== System capabilities (bcaps) ==
 
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.
 
{| class="wikitable_list"
! Bit
! Mask
! Name
! Description
|-
| 0
| 0x00000001
| CHOWN
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
|-
| 1
| 0x00000002
| DAC_OVERRIDE
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
|-
| 2
| 0x00000004
| DAC_READ_SEARCH
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
|-
| 3
| 0x00000008
| FOWNER
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
|-
| 4
| 0x00000010
| FSETID
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
|-
| 5
| 0x00000020
| KILL
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
|-
| 6
| 0x00000040
| SETGID
|
* Allows setgid(2) manipulation
* Allows setgroups(2)
* Allows forged gids on socket credentials passing.
|-
| 7
| 0x00000080
| SETUID
|
* Allows set*uid(2) manipulation (including fsuid).
* Allows forged pids on socket credentials passing.
|-
| 8
| 0x00000100
| SETPCAP
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
|-
| 9
| 0x00000200
| LINUX_IMMUTABLE
| Allow modification of S_IMMUTABLE and S_APPEND file attributes
|-
| 10
| 0x00000400
| NET_BIND_SERVICE
|
* Allows binding to TCP/UDP sockets below 1024
* Allows binding to ATM VCIs below 32
|-
| 11
| 0x00000800
| NET_BROADCAST
| Allow broadcasting, listen to multicast
|-
| 12
| 0x00001000
| NET_ADMIN
|
|
Make network context persistent
* Allow interface configuration
* Allow administration of IP firewall, masquerading and accounting
* Allow setting debug option on sockets
* Allow modification of routing tables
* Allow setting arbitrary process / process group ownership on sockets
* Allow binding to any address for transparent proxying
* Allow setting TOS (type of service)
* Allow setting promiscuous mode
* Allow clearing driver statistics
* Allow multicasting
* Allow read/write of device-specific registers
* Allow activation of ATM control sockets
|-
| 13
| 0x00002000
| NET_RAW
|
* Allow use of RAW sockets
* Allow use of PACKET sockets
|-
| 14
| 0x00004000
| IPC_LOCK
|
* Allow locking of shared memory segments
* Allow mlock and mlockall (which doesn't really have anything to do with IPC)
|-
| 15
| 0x00008000
| IPC_OWNER
| Override IPC ownership checks
|-
| 16
| 0x00010000
| SYS_MODULE
|
* Insert and remove kernel modules - modify kernel without limit
* Modify cap_bset
|-
| 17
| 0x00020000
| SYS_RAWIO
|
* Allow ioperm/iopl access
* Allow sending USB messages to any device via /proc/bus/usb
|-
| 18
| 0x00040000
| SYS_CHROOT
| * Allow use of chroot()
|-
| 19
| 0x00080000
| SYS_PTRACE
| Allow ptrace() of any process
|-
| 20
| 0x00100000
| SYS_PACCT
| Allow configuration of process accounting
|-
| 21
| 0x00200000
| SYS_ADMIN
|
* Allow configuration of the secure attention key
* Allow administration of the random device
* Allow examination and configuration of disk quotas
* Allow configuring the kernel's syslog (printk behaviour)
* Allow setting the domainname
* Allow setting the hostname
* Allow calling bdflush()
* Allow mount() and umount(), setting up new smb connection
* Allow some autofs root ioctls
* Allow nfsservctl
* Allow VM86_REQUEST_IRQ
* Allow to read/write pci config on alpha
* Allow irix_prctl on mips (setstacksize)
* Allow flushing all cache on m68k (sys_cacheflush)
* Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory)
* Allow locking/unlocking of shared memory segment
* Allow turning swap on/off
* Allow forged pids on socket credentials passing
* Allow setting readahead and flushing buffers on block devices
* Allow setting geometry in floppy driver
* Allow turning DMA on/off in xd driver
* Allow administration of md devices (mostly the above, but some extra ioctls)
* Allow tuning the ide driver
* Allow access to the nvram device
* Allow administration of apm_bios, serial and bttv (TV) device
* Allow manufacturer commands in isdn CAPI support driver
* Allow reading non-standardized portions of pci configuration space
* Allow DDI debug ioctl on sbpcd driver
* Allow setting up serial ports
* Allow sending raw qic-117 commands
* Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands
* Allow setting encryption key on loopback filesystem
* Allow setting zone reclaim policy
|-
| 22
| 0x00400000
| SYS_BOOT
| Allow use of reboot()
|-
| 23
| 0x00800000
| SYS_NICE
|
* Allow raising priority and setting priority on other (different UID) processes
* Allow use of FIFO and round-robin (realtime) scheduling on own processes and setting the scheduling algorithm used by another process.
* Allow setting cpu affinity on other processes
|-
| 24
| 0x01000000
| SYS_RESOURCE
|
* Override resource limits. Set resource limits.
* Override quota limits.
* Override reserved space on ext2 filesystem
* Modify data journaling mode on ext3 filesystem (uses journaling resources)
* ''NOTE:'' ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too
* Override size restrictions on IPC message queues
* Allow more than 64hz interrupts from the real-time clock
* Override max number of consoles on console allocation
* Override max number of keymaps
|-
| 25
| 0x02000000
| SYS_TIME
|
* Allow manipulation of system clock
* Allow irix_stime on mips
* Allow setting the real-time clock
|-
| 26
| 0x04000000
| SYS_TTY_CONFIG
|
* Allow configuration of tty devices
* Allow vhangup() of tty
|-
| 27
| 0x08000000
| MKNOD
| Allow the privileged aspects of mknod()
|-
| 28
| 0x10000000
| LEASE
| Allow taking of leases on files
|-
| 29
| 0x20000000
| AUDIT_WRITE
| ??
|-
| 30
| 0x40000000
| AUDIT_CONTROL
| ??
|}
|}

Revision as of 17:08, 22 October 2006


Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:

Bit
The bit number to enable the capability/flag
Mask
The bit number in hexadecimal notation
Name
Human readable identifier used in userspace utilities
Tag
Special capability/flag code to denote special behaviour, legacy usage and others (see below)
Description
Description of capability/flag effects

Special capability/flags codes

The tag column may contain one or more of the following tags:

Tag Description
I Internal use only
L Only supported with legacy enabled
O One time capability/flag
U Unsupported
X Slightly different meaning in legacy

Context capabilities (ccaps)

The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 SET_UTSNAME Allow setdomainname(2) and sethostname(2)
1 0x00000002 SET_RLIMIT Allow setrlimit(2)
8 0x00000100 RAW_ICMP Allow usage of raw ICMP sockets
12 0x00001000 SYSLOG Allow syslog(2)
16 0x00010000 SECURE_MOUNT Allow secure mount(2)
17 0x00020000 SECURE_REMOUNT Allow secure remount
18 0x00040000 BINARY_MOUNT Allow binary/network mounts
20 0x00100000 QUOTA_CTL Allow quota ioctls
21 0x00200000 ADMIN_MAPPER Allow access to device mapper
22 0x00400000 ADMIN_CLOOP Allow access to loop devices

Context flags (cflags)

The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 INFO_LOCK L Prohibit further context migration
1 0x00000002 INFO_SCHED L Account all processes as one
2 0x00000004 INFO_NPROC L Apply process limits to context
3 0x00000008 INFO_PRIVATE L Context cannot be entered
4 0x00000010 INFO_INIT X Show a fake init process
5 0x00000020 INFO_HIDE X Hide context information in task status
6 0x00000040 INFO_ULIMIT L Apply ulimits to context
7 0x00000080 INFO_NSPACE L Use private namespace
8 0x00000100 SCHED_HARD Enable hard scheduler
9 0x00000200 SCHED_PRIO Enable priority scheduler
10 0x00000400 SCHED_PAUSE Pause context (unschedule)
20 0x00010000 VIRT_MEM Virtualize memory information
21 0x00020000 VIRT_UPTIME Virtualize uptime information
22 0x00040000 VIRT_CPU Virtualize cpu usage information
23 0x00080000 VIRT_LOAD Virtualize load average information
24 0x00100000 VIRT_TIME Allow per guest time offsets
28 0x01000000 HIDE_MOUNT Hide entries in /proc/$pid/mounts
29 0x02000000 HIDE_NETIF Hide foreign network interfaces
30 0x04000000 HIDE_VINFO Hide context information in task status
32 (1ULL<<32) STATE_SETUP IO Enable setup state
33 (1ULL<<33) STATE_INIT IO Enable init state
34 (1ULL<<34) STATE_ADMIN O Enable admin state
36 (1ULL<<36) SC_HELPER I Enable state change helper
37 (1ULL<<37) REBOOT_KILL Kill all processes on reboot(2)
38 (1ULL<<38) PERSISTENT Make context persistent
0 (1ULL<<48) FORK_RSS Block fork when RSS limit is exceeded
0 (1ULL<<49) PROLIFIC Allow context to create new contexts
0 (1ULL<<52) IGNEG_NICE Ignore priority raise


Network context flags (nflags)

The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 INFO_LOCK Prohibit further context migration
8 0x00000100 SINGLE_IP Enable special handling of network contexts with a single IP only
29 0x02000000 HIDE_NETIF Hide foreign network interfaces
32 (1ULL<<32) STATE_SETUP OI Enable setup state
34 (1ULL<<34) STATE_ADMIN O Enable admin state
36 (1ULL<<36) SC_HELPER I Enable state change helper
38 (1ULL<<38) PERSISTENT Make network context persistent

System capabilities (bcaps)

The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.

Bit Mask Name Description
0 0x00000001 CHOWN In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
1 0x00000002 DAC_OVERRIDE Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
2 0x00000004 DAC_READ_SEARCH Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
3 0x00000008 FOWNER Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
4 0x00000010 FSETID Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
5 0x00000020 KILL Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
6 0x00000040 SETGID
  • Allows setgid(2) manipulation
  • Allows setgroups(2)
  • Allows forged gids on socket credentials passing.
7 0x00000080 SETUID
  • Allows set*uid(2) manipulation (including fsuid).
  • Allows forged pids on socket credentials passing.
8 0x00000100 SETPCAP Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
9 0x00000200 LINUX_IMMUTABLE Allow modification of S_IMMUTABLE and S_APPEND file attributes
10 0x00000400 NET_BIND_SERVICE
  • Allows binding to TCP/UDP sockets below 1024
  • Allows binding to ATM VCIs below 32
11 0x00000800 NET_BROADCAST Allow broadcasting, listen to multicast
12 0x00001000 NET_ADMIN
  • Allow interface configuration
  • Allow administration of IP firewall, masquerading and accounting
  • Allow setting debug option on sockets
  • Allow modification of routing tables
  • Allow setting arbitrary process / process group ownership on sockets
  • Allow binding to any address for transparent proxying
  • Allow setting TOS (type of service)
  • Allow setting promiscuous mode
  • Allow clearing driver statistics
  • Allow multicasting
  • Allow read/write of device-specific registers
  • Allow activation of ATM control sockets
13 0x00002000 NET_RAW
  • Allow use of RAW sockets
  • Allow use of PACKET sockets
14 0x00004000 IPC_LOCK
  • Allow locking of shared memory segments
  • Allow mlock and mlockall (which doesn't really have anything to do with IPC)
15 0x00008000 IPC_OWNER Override IPC ownership checks
16 0x00010000 SYS_MODULE
  • Insert and remove kernel modules - modify kernel without limit
  • Modify cap_bset
17 0x00020000 SYS_RAWIO
  • Allow ioperm/iopl access
  • Allow sending USB messages to any device via /proc/bus/usb
18 0x00040000 SYS_CHROOT * Allow use of chroot()
19 0x00080000 SYS_PTRACE Allow ptrace() of any process
20 0x00100000 SYS_PACCT Allow configuration of process accounting
21 0x00200000 SYS_ADMIN
  • Allow configuration of the secure attention key
  • Allow administration of the random device
  • Allow examination and configuration of disk quotas
  • Allow configuring the kernel's syslog (printk behaviour)
  • Allow setting the domainname
  • Allow setting the hostname
  • Allow calling bdflush()
  • Allow mount() and umount(), setting up new smb connection
  • Allow some autofs root ioctls
  • Allow nfsservctl
  • Allow VM86_REQUEST_IRQ
  • Allow to read/write pci config on alpha
  • Allow irix_prctl on mips (setstacksize)
  • Allow flushing all cache on m68k (sys_cacheflush)
  • Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory)
  • Allow locking/unlocking of shared memory segment
  • Allow turning swap on/off
  • Allow forged pids on socket credentials passing
  • Allow setting readahead and flushing buffers on block devices
  • Allow setting geometry in floppy driver
  • Allow turning DMA on/off in xd driver
  • Allow administration of md devices (mostly the above, but some extra ioctls)
  • Allow tuning the ide driver
  • Allow access to the nvram device
  • Allow administration of apm_bios, serial and bttv (TV) device
  • Allow manufacturer commands in isdn CAPI support driver
  • Allow reading non-standardized portions of pci configuration space
  • Allow DDI debug ioctl on sbpcd driver
  • Allow setting up serial ports
  • Allow sending raw qic-117 commands
  • Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands
  • Allow setting encryption key on loopback filesystem
  • Allow setting zone reclaim policy
22 0x00400000 SYS_BOOT Allow use of reboot()
23 0x00800000 SYS_NICE
  • Allow raising priority and setting priority on other (different UID) processes
  • Allow use of FIFO and round-robin (realtime) scheduling on own processes and setting the scheduling algorithm used by another process.
  • Allow setting cpu affinity on other processes
24 0x01000000 SYS_RESOURCE
  • Override resource limits. Set resource limits.
  • Override quota limits.
  • Override reserved space on ext2 filesystem
  • Modify data journaling mode on ext3 filesystem (uses journaling resources)
  • NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too
  • Override size restrictions on IPC message queues
  • Allow more than 64hz interrupts from the real-time clock
  • Override max number of consoles on console allocation
  • Override max number of keymaps
25 0x02000000 SYS_TIME
  • Allow manipulation of system clock
  • Allow irix_stime on mips
  • Allow setting the real-time clock
26 0x04000000 SYS_TTY_CONFIG
  • Allow configuration of tty devices
  • Allow vhangup() of tty
27 0x08000000 MKNOD Allow the privileged aspects of mknod()
28 0x10000000 LEASE Allow taking of leases on files
29 0x20000000 AUDIT_WRITE ??
30 0x40000000 AUDIT_CONTROL ??