Capabilities and Flags: Difference between revisions

From Linix VServer
Jump to navigationJump to search
imported>Hollow
No edit summary
imported>Hollow
No edit summary
Line 44: Line 44:
! Description
! Description
|-
|-
| 0
| style="text-align: right" | 0
| 0x00000001
| style="font-family: monospace" | 0x00000001
| SET_UTSNAME
| SET_UTSNAME
|
|
| Allow setdomainname(2) and sethostname(2)
| Allow setdomainname(2) and sethostname(2)
|-
|-
| 1
| style="text-align: right" | 1
| 0x00000002
| style="font-family: monospace" | 0x00000002
| SET_RLIMIT
| SET_RLIMIT
|
|
| Allow setrlimit(2)
| Allow setrlimit(2)
|-
|-
| 8
| style="text-align: right" | 8
| 0x00000100
| style="font-family: monospace" | 0x00000100
| RAW_ICMP
| RAW_ICMP
|
|
| Allow usage of raw ICMP sockets
| Allow usage of raw ICMP sockets
|-
|-
| 12
| style="text-align: right" | 12
| 0x00001000
| style="font-family: monospace" | 0x00001000
| SYSLOG
| SYSLOG
|
|
| Allow syslog(2)
| Allow syslog(2)
|-
|-
| 16
| style="text-align: right" | 16
| 0x00010000
| style="font-family: monospace" | 0x00010000
| SECURE_MOUNT
| SECURE_MOUNT
|
|
| Allow secure mount(2)
| Allow secure mount(2)
|-
|-
| 17
| style="text-align: right" | 17
| 0x00020000
| style="font-family: monospace" | 0x00020000
| SECURE_REMOUNT
| SECURE_REMOUNT
|
|
| Allow secure remount
| Allow secure remount
|-
|-
| 18
| style="text-align: right" | 18
| 0x00040000
| style="font-family: monospace" | 0x00040000
| BINARY_MOUNT
| BINARY_MOUNT
|
|
| Allow binary/network mounts
| Allow binary/network mounts
|-
|-
| 20
| style="text-align: right" | 20
| 0x00100000
| style="font-family: monospace" | 0x00100000
| QUOTA_CTL
| QUOTA_CTL
|
|
| Allow quota ioctls
| Allow quota ioctls
|-
|-
| 21
| style="text-align: right" | 21
| 0x00200000
| style="font-family: monospace" | 0x00200000
| ADMIN_MAPPER
| ADMIN_MAPPER
|
|
| Allow access to device mapper
| Allow access to device mapper
|-
|-
| 22
| style="text-align: right" | 22
| 0x00400000
| style="font-family: monospace" | 0x00400000
| ADMIN_CLOOP
| ADMIN_CLOOP
|
|
Line 116: Line 116:
! Description
! Description
|-
|-
| 0
| style="text-align: right" | 0
| 0x00000001
| style="font-family: monospace" | 0x00000001
| INFO_LOCK
| INFO_LOCK
| L
| L
| Prohibit further context migration
| Prohibit further context migration
|-
|-
| 1
| style="text-align: right" | 1
| 0x00000002
| style="font-family: monospace" | 0x00000002
| INFO_SCHED
| INFO_SCHED
| L
| L
| Account all processes as one
| Account all processes as one
|-
|-
| 2
| style="text-align: right" | 2
| 0x00000004
| style="font-family: monospace" | 0x00000004
| INFO_NPROC
| INFO_NPROC
| L
| L
| Apply process limits to context
| Apply process limits to context
|-
|-
| 3
| style="text-align: right" | 3
| 0x00000008
| style="font-family: monospace" | 0x00000008
| INFO_PRIVATE
| INFO_PRIVATE
| L
| L
| Context cannot be entered
| Context cannot be entered
|-
|-
| 4
| style="text-align: right" | 4
| 0x00000010
| style="font-family: monospace" | 0x00000010
| INFO_INIT
| INFO_INIT
| X
| X
| Show a fake init process
| Show a fake init process
|-
|-
| 5
| style="text-align: right" | 5
| 0x00000020
| style="font-family: monospace" | 0x00000020
| INFO_HIDE
| INFO_HIDE
| X
| X
| Hide context information in task status
| Hide context information in task status
|-
|-
| 6
| style="text-align: right" | 6
| 0x00000040
| style="font-family: monospace" | 0x00000040
| INFO_ULIMIT
| INFO_ULIMIT
| L
| L
| Apply ulimits to context
| Apply ulimits to context
|-
|-
| 7
| style="text-align: right" | 7
| 0x00000080
| style="font-family: monospace" | 0x00000080
| INFO_NSPACE
| INFO_NSPACE
| L
| L
| Use private namespace
| Use private namespace
|-
|-
| 8
| style="text-align: right" | 8
| 0x00000100
| style="font-family: monospace" | 0x00000100
| SCHED_HARD
| SCHED_HARD
|
|
| Enable hard scheduler
| Enable hard scheduler
|-
|-
| 9
| style="text-align: right" | 9
| 0x00000200
| style="font-family: monospace" | 0x00000200
| SCHED_PRIO
| SCHED_PRIO
|
|
| Enable priority scheduler
| Enable priority scheduler
|-
|-
| 10
| style="text-align: right" | 10
| 0x00000400
| style="font-family: monospace" | 0x00000400
| SCHED_PAUSE
| SCHED_PAUSE
|
|
| Pause context (unschedule)
| Pause context (unschedule)
|-
|-
| 20
| style="text-align: right" | 20
| 0x00010000
| style="font-family: monospace" | 0x00010000
| VIRT_MEM
| VIRT_MEM
|
|
| Virtualize memory information
| Virtualize memory information
|-
|-
| 21
| style="text-align: right" | 21
| 0x00020000
| style="font-family: monospace" | 0x00020000
| VIRT_UPTIME
| VIRT_UPTIME
|
|
| Virtualize uptime information
| Virtualize uptime information
|-
|-
| 22
| style="text-align: right" | 22
| 0x00040000
| style="font-family: monospace" | 0x00040000
| VIRT_CPU
| VIRT_CPU
|
|
| Virtualize cpu usage information
| Virtualize cpu usage information
|-
|-
| 23
| style="text-align: right" | 23
| 0x00080000
| style="font-family: monospace" | 0x00080000
| VIRT_LOAD
| VIRT_LOAD
|
|
| Virtualize load average information
| Virtualize load average information
|-
|-
| 24
| style="text-align: right" | 24
| 0x00100000
| style="font-family: monospace" | 0x00100000
| VIRT_TIME
| VIRT_TIME
|
|
| Allow per guest time offsets
| Allow per guest time offsets
|-
|-
| 28
| style="text-align: right" | 28
| 0x01000000
| style="font-family: monospace" | 0x01000000
| HIDE_MOUNT
| HIDE_MOUNT
|
|
| Hide entries in /proc/$pid/mounts
| Hide entries in /proc/$pid/mounts
|-
|-
| 29
| style="text-align: right" | 29
| 0x02000000
| style="font-family: monospace" | 0x02000000
| HIDE_NETIF
| HIDE_NETIF
|
|
| Hide foreign network interfaces
| Hide foreign network interfaces
|-
|-
| 30
| style="text-align: right" | 30
| 0x04000000
| style="font-family: monospace" | 0x04000000
| HIDE_VINFO
| HIDE_VINFO
|
|
| Hide context information in task status
| Hide context information in task status
|-
|-
| 32
| style="text-align: right" | 32
| (1ULL<<32)
| style="font-family: monospace" | 0x0001<<32
| STATE_SETUP
| STATE_SETUP
| IO
| IO
| Enable setup state
| Enable setup state
|-
|-
| 33
| style="text-align: right" | 33
| (1ULL<<33)
| style="font-family: monospace" | 0x0001<<33
| STATE_INIT
| STATE_INIT
| IO
| IO
| Enable init state
| Enable init state
|-
|-
| 34
| style="text-align: right" | 34
| (1ULL<<34)
| style="font-family: monospace" | 0x0001<<34
| STATE_ADMIN
| STATE_ADMIN
| O
| O
| Enable admin state
| Enable admin state
|-
|-
| 36
| style="text-align: right" | 36
| (1ULL<<36)
| style="font-family: monospace" | 0x0001<<36
| SC_HELPER
| SC_HELPER
| I
| I
| Enable state change helper
| Enable state change helper
|-
|-
| 37
| style="text-align: right" | 37
| (1ULL<<37)
| style="font-family: monospace" | 0x0001<<37
| REBOOT_KILL
| REBOOT_KILL
|
|
| Kill all processes on reboot(2)
| Kill all processes on reboot(2)
|-
|-
| 38
| style="text-align: right" | 38
| (1ULL<<38)
| style="font-family: monospace" | 0x0001<<38
| PERSISTENT
| PERSISTENT
|
|
| Make context persistent
| Make context persistent
|-
|-
| 0
| style="text-align: right" | 48
| (1ULL<<48)
| style="font-family: monospace" | 0x0001<<48
| FORK_RSS
| FORK_RSS
|
|
| Block fork when RSS limit is exceeded
| Block fork when RSS limit is exceeded
|-
|-
| 0
| style="text-align: right" | 49
| (1ULL<<49)
| style="font-family: monospace" | 0x0001<<49
| PROLIFIC
| PROLIFIC
|
|
| Allow context to create new contexts
| Allow context to create new contexts
|-
|-
| 0
| style="text-align: right" | 52
| (1ULL<<52)
| style="font-family: monospace" | 0x0001<<52
| IGNEG_NICE
| IGNEG_NICE
|
|
Line 297: Line 297:
! Description
! Description
|-
|-
| 0
| style="text-align: right" | 0
| 0x00000001
| style="font-family: monospace" | 0x00000001
| INFO_LOCK
| INFO_LOCK
|
|
| Prohibit further context migration
| Prohibit further context migration
|-
|-
| 8
| style="text-align: right" | 8
| 0x00000100
| style="font-family: monospace" | 0x00000100
| SINGLE_IP
| SINGLE_IP
|
|
| Enable special handling of network contexts with a single IP only
| Enable special handling of network contexts with a single IP only
|-
|-
| 29
| style="text-align: right" | 29
| 0x02000000
| style="font-family: monospace" | 0x02000000
| HIDE_NETIF
| HIDE_NETIF
|
|
| Hide foreign network interfaces
| Hide foreign network interfaces
|-
|-
| 32
| style="text-align: right" | 32
| (1ULL<<32)
| style="font-family: monospace" | 0x0001<<32
| STATE_SETUP
| STATE_SETUP
| OI
| IO
| Enable setup state
| Enable setup state
|-
|-
| 34
| style="text-align: right" | 34
| (1ULL<<34)
| style="font-family: monospace" | 0x0001<<34
| STATE_ADMIN
| STATE_ADMIN
| O
| O
| Enable admin state
| Enable admin state
|-
|-
| 36
| style="text-align: right" | 36
| (1ULL<<36)
| style="font-family: monospace" | 0x0001<<36
| SC_HELPER
| SC_HELPER
| I
| I
| Enable state change helper
| Enable state change helper
|-
|-
| 38
| style="text-align: right" | 38
| (1ULL<<38)
| style="font-family: monospace" | 0x0001<<38
| PERSISTENT
| PERSISTENT
|
|
Line 350: Line 350:
! Description
! Description
|-
|-
| 0
| style="text-align: right" | 0
| 0x00000001
| style="font-family: monospace" | 0x00000001
| CHOWN
| CHOWN
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
|-
|-
| 1
| style="text-align: right" | 1
| 0x00000002
| style="font-family: monospace" | 0x00000002
| DAC_OVERRIDE
| DAC_OVERRIDE
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
|-
|-
| 2
| style="text-align: right" | 2
| 0x00000004
| style="font-family: monospace" | 0x00000004
| DAC_READ_SEARCH
| DAC_READ_SEARCH
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
|-
|-
| 3
| style="text-align: right" | 3
| 0x00000008
| style="font-family: monospace" | 0x00000008
| FOWNER
| FOWNER
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
|-
|-
| 4
| style="text-align: right" | 4
| 0x00000010
| style="font-family: monospace" | 0x00000010
| FSETID
| FSETID
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
|-
|-
| 5
| style="text-align: right" | 5
| 0x00000020
| style="font-family: monospace" | 0x00000020
| KILL
| KILL
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
|-
|-
| 6
| style="text-align: right" | 6
| 0x00000040
| style="font-family: monospace" | 0x00000040
| SETGID
| SETGID
|
|
Line 388: Line 388:
* Allows forged gids on socket credentials passing.
* Allows forged gids on socket credentials passing.
|-
|-
| 7
| style="text-align: right" | 7
| 0x00000080
| style="font-family: monospace" | 0x00000080
| SETUID
| SETUID
|
|
Line 395: Line 395:
* Allows forged pids on socket credentials passing.
* Allows forged pids on socket credentials passing.
|-
|-
| 8
| style="text-align: right" | 8
| 0x00000100
| style="font-family: monospace" | 0x00000100
| SETPCAP
| SETPCAP
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
|-
|-
| 9
| style="text-align: right" | 9
| 0x00000200
| style="font-family: monospace" | 0x00000200
| LINUX_IMMUTABLE
| LINUX_IMMUTABLE
| Allow modification of S_IMMUTABLE and S_APPEND file attributes
| Allow modification of S_IMMUTABLE and S_APPEND file attributes
|-
|-
| 10
| style="text-align: right" | 10
| 0x00000400
| style="font-family: monospace" | 0x00000400
| NET_BIND_SERVICE
| NET_BIND_SERVICE
|
|
Line 412: Line 412:
* Allows binding to ATM VCIs below 32
* Allows binding to ATM VCIs below 32
|-
|-
| 11
| style="text-align: right" | 11
| 0x00000800
| style="font-family: monospace" | 0x00000800
| NET_BROADCAST
| NET_BROADCAST
| Allow broadcasting, listen to multicast
| Allow broadcasting, listen to multicast
|-
|-
| 12
| style="text-align: right" | 12
| 0x00001000
| style="font-family: monospace" | 0x00001000
| NET_ADMIN
| NET_ADMIN
|
|
Line 434: Line 434:
* Allow activation of ATM control sockets
* Allow activation of ATM control sockets
|-
|-
| 13
| style="text-align: right" | 13
| 0x00002000
| style="font-family: monospace" | 0x00002000
| NET_RAW
| NET_RAW
|
|
Line 441: Line 441:
* Allow use of PACKET sockets
* Allow use of PACKET sockets
|-
|-
| 14
| style="text-align: right" | 14
| 0x00004000
| style="font-family: monospace" | 0x00004000
| IPC_LOCK
| IPC_LOCK
|
|
Line 448: Line 448:
* Allow mlock and mlockall (which doesn't really have anything to do with IPC)
* Allow mlock and mlockall (which doesn't really have anything to do with IPC)
|-
|-
| 15
| style="text-align: right" | 15
| 0x00008000
| style="font-family: monospace" | 0x00008000
| IPC_OWNER
| IPC_OWNER
| Override IPC ownership checks
| Override IPC ownership checks
|-
|-
| 16
| style="text-align: right" | 16
| 0x00010000
| style="font-family: monospace" | 0x00010000
| SYS_MODULE
| SYS_MODULE
|
|
Line 460: Line 460:
* Modify cap_bset
* Modify cap_bset
|-
|-
| 17
| style="text-align: right" | 17
| 0x00020000
| style="font-family: monospace" | 0x00020000
| SYS_RAWIO
| SYS_RAWIO
|
|
Line 467: Line 467:
* Allow sending USB messages to any device via /proc/bus/usb
* Allow sending USB messages to any device via /proc/bus/usb
|-
|-
| 18
| style="text-align: right" | 18
| 0x00040000
| style="font-family: monospace" | 0x00040000
| SYS_CHROOT
| SYS_CHROOT
| * Allow use of chroot()
| Allow use of chroot()
|-
|-
| 19
| style="text-align: right" | 19
| 0x00080000
| style="font-family: monospace" | 0x00080000
| SYS_PTRACE
| SYS_PTRACE
| Allow ptrace() of any process
| Allow ptrace() of any process
|-
|-
| 20
| style="text-align: right" | 20
| 0x00100000
| style="font-family: monospace" | 0x00100000
| SYS_PACCT
| SYS_PACCT
| Allow configuration of process accounting
| Allow configuration of process accounting
|-
|-
| 21
| style="text-align: right" | 21
| 0x00200000
| style="font-family: monospace" | 0x00200000
| SYS_ADMIN
| SYS_ADMIN
|
|
Line 520: Line 520:
* Allow setting zone reclaim policy
* Allow setting zone reclaim policy
|-
|-
| 22
| style="text-align: right" | 22
| 0x00400000
| style="font-family: monospace" | 0x00400000
| SYS_BOOT
| SYS_BOOT
| Allow use of reboot()
| Allow use of reboot()
|-
|-
| 23
| style="text-align: right" | 23
| 0x00800000
| style="font-family: monospace" | 0x00800000
| SYS_NICE
| SYS_NICE
|
|
Line 533: Line 533:
* Allow setting cpu affinity on other processes
* Allow setting cpu affinity on other processes
|-
|-
| 24
| style="text-align: right" | 24
| 0x01000000
| style="font-family: monospace" | 0x01000000
| SYS_RESOURCE
| SYS_RESOURCE
|
|
Line 547: Line 547:
* Override max number of keymaps
* Override max number of keymaps
|-
|-
| 25
| style="text-align: right" | 25
| 0x02000000
| style="font-family: monospace" | 0x02000000
| SYS_TIME
| SYS_TIME
|
|
Line 555: Line 555:
* Allow setting the real-time clock
* Allow setting the real-time clock
|-
|-
| 26
| style="text-align: right" | 26
| 0x04000000
| style="font-family: monospace" | 0x04000000
| SYS_TTY_CONFIG
| SYS_TTY_CONFIG
|
|
Line 562: Line 562:
* Allow vhangup() of tty
* Allow vhangup() of tty
|-
|-
| 27
| style="text-align: right" | 27
| 0x08000000
| style="font-family: monospace" | 0x08000000
| MKNOD
| MKNOD
| Allow the privileged aspects of mknod()
| Allow the privileged aspects of mknod()
|-
|-
| 28
| style="text-align: right" | 28
| 0x10000000
| style="font-family: monospace" | 0x10000000
| LEASE
| LEASE
| Allow taking of leases on files
| Allow taking of leases on files
|-
|-
| 29
| style="text-align: right" | 29
| 0x20000000
| style="font-family: monospace" | 0x20000000
| AUDIT_WRITE
| AUDIT_WRITE
| ??
| ??
|-
|-
| 30
| style="text-align: right" | 30
| 0x40000000
| style="font-family: monospace" | 0x40000000
| AUDIT_CONTROL
| AUDIT_CONTROL
| ??
| ??
|}
|}

Revision as of 17:43, 22 October 2006


Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:

Bit
The bit number to enable the capability/flag
Mask
The bit number in hexadecimal notation
Name
Human readable identifier used in userspace utilities
Tag
Special capability/flag code to denote special behaviour, legacy usage and others (see below)
Description
Description of capability/flag effects

Special capability/flags codes

The tag column may contain one or more of the following tags:

Tag Description
I Internal use only
L Only supported with legacy enabled
O One time capability/flag
U Unsupported
X Slightly different meaning in legacy

Context capabilities (ccaps)

The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 SET_UTSNAME Allow setdomainname(2) and sethostname(2)
1 0x00000002 SET_RLIMIT Allow setrlimit(2)
8 0x00000100 RAW_ICMP Allow usage of raw ICMP sockets
12 0x00001000 SYSLOG Allow syslog(2)
16 0x00010000 SECURE_MOUNT Allow secure mount(2)
17 0x00020000 SECURE_REMOUNT Allow secure remount
18 0x00040000 BINARY_MOUNT Allow binary/network mounts
20 0x00100000 QUOTA_CTL Allow quota ioctls
21 0x00200000 ADMIN_MAPPER Allow access to device mapper
22 0x00400000 ADMIN_CLOOP Allow access to loop devices

Context flags (cflags)

The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 INFO_LOCK L Prohibit further context migration
1 0x00000002 INFO_SCHED L Account all processes as one
2 0x00000004 INFO_NPROC L Apply process limits to context
3 0x00000008 INFO_PRIVATE L Context cannot be entered
4 0x00000010 INFO_INIT X Show a fake init process
5 0x00000020 INFO_HIDE X Hide context information in task status
6 0x00000040 INFO_ULIMIT L Apply ulimits to context
7 0x00000080 INFO_NSPACE L Use private namespace
8 0x00000100 SCHED_HARD Enable hard scheduler
9 0x00000200 SCHED_PRIO Enable priority scheduler
10 0x00000400 SCHED_PAUSE Pause context (unschedule)
20 0x00010000 VIRT_MEM Virtualize memory information
21 0x00020000 VIRT_UPTIME Virtualize uptime information
22 0x00040000 VIRT_CPU Virtualize cpu usage information
23 0x00080000 VIRT_LOAD Virtualize load average information
24 0x00100000 VIRT_TIME Allow per guest time offsets
28 0x01000000 HIDE_MOUNT Hide entries in /proc/$pid/mounts
29 0x02000000 HIDE_NETIF Hide foreign network interfaces
30 0x04000000 HIDE_VINFO Hide context information in task status
32 0x0001<<32 STATE_SETUP IO Enable setup state
33 0x0001<<33 STATE_INIT IO Enable init state
34 0x0001<<34 STATE_ADMIN O Enable admin state
36 0x0001<<36 SC_HELPER I Enable state change helper
37 0x0001<<37 REBOOT_KILL Kill all processes on reboot(2)
38 0x0001<<38 PERSISTENT Make context persistent
48 0x0001<<48 FORK_RSS Block fork when RSS limit is exceeded
49 0x0001<<49 PROLIFIC Allow context to create new contexts
52 0x0001<<52 IGNEG_NICE Ignore priority raise


Network context flags (nflags)

The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.

Bit Mask Name Tag Description
0 0x00000001 INFO_LOCK Prohibit further context migration
8 0x00000100 SINGLE_IP Enable special handling of network contexts with a single IP only
29 0x02000000 HIDE_NETIF Hide foreign network interfaces
32 0x0001<<32 STATE_SETUP IO Enable setup state
34 0x0001<<34 STATE_ADMIN O Enable admin state
36 0x0001<<36 SC_HELPER I Enable state change helper
38 0x0001<<38 PERSISTENT Make network context persistent

System capabilities (bcaps)

The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.

Bit Mask Name Description
0 0x00000001 CHOWN In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.
1 0x00000002 DAC_OVERRIDE Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
2 0x00000004 DAC_READ_SEARCH Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.
3 0x00000008 FOWNER Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.
4 0x00000010 FSETID Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).
5 0x00000020 KILL Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
6 0x00000040 SETGID
  • Allows setgid(2) manipulation
  • Allows setgroups(2)
  • Allows forged gids on socket credentials passing.
7 0x00000080 SETUID
  • Allows set*uid(2) manipulation (including fsuid).
  • Allows forged pids on socket credentials passing.
8 0x00000100 SETPCAP Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid
9 0x00000200 LINUX_IMMUTABLE Allow modification of S_IMMUTABLE and S_APPEND file attributes
10 0x00000400 NET_BIND_SERVICE
  • Allows binding to TCP/UDP sockets below 1024
  • Allows binding to ATM VCIs below 32
11 0x00000800 NET_BROADCAST Allow broadcasting, listen to multicast
12 0x00001000 NET_ADMIN
  • Allow interface configuration
  • Allow administration of IP firewall, masquerading and accounting
  • Allow setting debug option on sockets
  • Allow modification of routing tables
  • Allow setting arbitrary process / process group ownership on sockets
  • Allow binding to any address for transparent proxying
  • Allow setting TOS (type of service)
  • Allow setting promiscuous mode
  • Allow clearing driver statistics
  • Allow multicasting
  • Allow read/write of device-specific registers
  • Allow activation of ATM control sockets
13 0x00002000 NET_RAW
  • Allow use of RAW sockets
  • Allow use of PACKET sockets
14 0x00004000 IPC_LOCK
  • Allow locking of shared memory segments
  • Allow mlock and mlockall (which doesn't really have anything to do with IPC)
15 0x00008000 IPC_OWNER Override IPC ownership checks
16 0x00010000 SYS_MODULE
  • Insert and remove kernel modules - modify kernel without limit
  • Modify cap_bset
17 0x00020000 SYS_RAWIO
  • Allow ioperm/iopl access
  • Allow sending USB messages to any device via /proc/bus/usb
18 0x00040000 SYS_CHROOT Allow use of chroot()
19 0x00080000 SYS_PTRACE Allow ptrace() of any process
20 0x00100000 SYS_PACCT Allow configuration of process accounting
21 0x00200000 SYS_ADMIN
  • Allow configuration of the secure attention key
  • Allow administration of the random device
  • Allow examination and configuration of disk quotas
  • Allow configuring the kernel's syslog (printk behaviour)
  • Allow setting the domainname
  • Allow setting the hostname
  • Allow calling bdflush()
  • Allow mount() and umount(), setting up new smb connection
  • Allow some autofs root ioctls
  • Allow nfsservctl
  • Allow VM86_REQUEST_IRQ
  • Allow to read/write pci config on alpha
  • Allow irix_prctl on mips (setstacksize)
  • Allow flushing all cache on m68k (sys_cacheflush)
  • Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory)
  • Allow locking/unlocking of shared memory segment
  • Allow turning swap on/off
  • Allow forged pids on socket credentials passing
  • Allow setting readahead and flushing buffers on block devices
  • Allow setting geometry in floppy driver
  • Allow turning DMA on/off in xd driver
  • Allow administration of md devices (mostly the above, but some extra ioctls)
  • Allow tuning the ide driver
  • Allow access to the nvram device
  • Allow administration of apm_bios, serial and bttv (TV) device
  • Allow manufacturer commands in isdn CAPI support driver
  • Allow reading non-standardized portions of pci configuration space
  • Allow DDI debug ioctl on sbpcd driver
  • Allow setting up serial ports
  • Allow sending raw qic-117 commands
  • Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands
  • Allow setting encryption key on loopback filesystem
  • Allow setting zone reclaim policy
22 0x00400000 SYS_BOOT Allow use of reboot()
23 0x00800000 SYS_NICE
  • Allow raising priority and setting priority on other (different UID) processes
  • Allow use of FIFO and round-robin (realtime) scheduling on own processes and setting the scheduling algorithm used by another process.
  • Allow setting cpu affinity on other processes
24 0x01000000 SYS_RESOURCE
  • Override resource limits. Set resource limits.
  • Override quota limits.
  • Override reserved space on ext2 filesystem
  • Modify data journaling mode on ext3 filesystem (uses journaling resources)
  • NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too
  • Override size restrictions on IPC message queues
  • Allow more than 64hz interrupts from the real-time clock
  • Override max number of consoles on console allocation
  • Override max number of keymaps
25 0x02000000 SYS_TIME
  • Allow manipulation of system clock
  • Allow irix_stime on mips
  • Allow setting the real-time clock
26 0x04000000 SYS_TTY_CONFIG
  • Allow configuration of tty devices
  • Allow vhangup() of tty
27 0x08000000 MKNOD Allow the privileged aspects of mknod()
28 0x10000000 LEASE Allow taking of leases on files
29 0x20000000 AUDIT_WRITE ??
30 0x40000000 AUDIT_CONTROL ??