Capabilities and Flags: Difference between revisions
imported>Hollow No edit summary |
imported>Hollow No edit summary |
||
| Line 44: | Line 44: | ||
! Description | ! Description | ||
|- | |- | ||
| 0 | | style="text-align: right" | 0 | ||
| 0x00000001 | | style="font-family: monospace" | 0x00000001 | ||
| SET_UTSNAME | | SET_UTSNAME | ||
| | | | ||
| Allow setdomainname(2) and sethostname(2) | | Allow setdomainname(2) and sethostname(2) | ||
|- | |- | ||
| 1 | | style="text-align: right" | 1 | ||
| 0x00000002 | | style="font-family: monospace" | 0x00000002 | ||
| SET_RLIMIT | | SET_RLIMIT | ||
| | | | ||
| Allow setrlimit(2) | | Allow setrlimit(2) | ||
|- | |- | ||
| 8 | | style="text-align: right" | 8 | ||
| 0x00000100 | | style="font-family: monospace" | 0x00000100 | ||
| RAW_ICMP | | RAW_ICMP | ||
| | | | ||
| Allow usage of raw ICMP sockets | | Allow usage of raw ICMP sockets | ||
|- | |- | ||
| 12 | | style="text-align: right" | 12 | ||
| 0x00001000 | | style="font-family: monospace" | 0x00001000 | ||
| SYSLOG | | SYSLOG | ||
| | | | ||
| Allow syslog(2) | | Allow syslog(2) | ||
|- | |- | ||
| 16 | | style="text-align: right" | 16 | ||
| 0x00010000 | | style="font-family: monospace" | 0x00010000 | ||
| SECURE_MOUNT | | SECURE_MOUNT | ||
| | | | ||
| Allow secure mount(2) | | Allow secure mount(2) | ||
|- | |- | ||
| 17 | | style="text-align: right" | 17 | ||
| 0x00020000 | | style="font-family: monospace" | 0x00020000 | ||
| SECURE_REMOUNT | | SECURE_REMOUNT | ||
| | | | ||
| Allow secure remount | | Allow secure remount | ||
|- | |- | ||
| 18 | | style="text-align: right" | 18 | ||
| 0x00040000 | | style="font-family: monospace" | 0x00040000 | ||
| BINARY_MOUNT | | BINARY_MOUNT | ||
| | | | ||
| Allow binary/network mounts | | Allow binary/network mounts | ||
|- | |- | ||
| 20 | | style="text-align: right" | 20 | ||
| 0x00100000 | | style="font-family: monospace" | 0x00100000 | ||
| QUOTA_CTL | | QUOTA_CTL | ||
| | | | ||
| Allow quota ioctls | | Allow quota ioctls | ||
|- | |- | ||
| 21 | | style="text-align: right" | 21 | ||
| 0x00200000 | | style="font-family: monospace" | 0x00200000 | ||
| ADMIN_MAPPER | | ADMIN_MAPPER | ||
| | | | ||
| Allow access to device mapper | | Allow access to device mapper | ||
|- | |- | ||
| 22 | | style="text-align: right" | 22 | ||
| 0x00400000 | | style="font-family: monospace" | 0x00400000 | ||
| ADMIN_CLOOP | | ADMIN_CLOOP | ||
| | | | ||
| Line 116: | Line 116: | ||
! Description | ! Description | ||
|- | |- | ||
| 0 | | style="text-align: right" | 0 | ||
| 0x00000001 | | style="font-family: monospace" | 0x00000001 | ||
| INFO_LOCK | | INFO_LOCK | ||
| L | | L | ||
| Prohibit further context migration | | Prohibit further context migration | ||
|- | |- | ||
| 1 | | style="text-align: right" | 1 | ||
| 0x00000002 | | style="font-family: monospace" | 0x00000002 | ||
| INFO_SCHED | | INFO_SCHED | ||
| L | | L | ||
| Account all processes as one | | Account all processes as one | ||
|- | |- | ||
| 2 | | style="text-align: right" | 2 | ||
| 0x00000004 | | style="font-family: monospace" | 0x00000004 | ||
| INFO_NPROC | | INFO_NPROC | ||
| L | | L | ||
| Apply process limits to context | | Apply process limits to context | ||
|- | |- | ||
| 3 | | style="text-align: right" | 3 | ||
| 0x00000008 | | style="font-family: monospace" | 0x00000008 | ||
| INFO_PRIVATE | | INFO_PRIVATE | ||
| L | | L | ||
| Context cannot be entered | | Context cannot be entered | ||
|- | |- | ||
| 4 | | style="text-align: right" | 4 | ||
| 0x00000010 | | style="font-family: monospace" | 0x00000010 | ||
| INFO_INIT | | INFO_INIT | ||
| X | | X | ||
| Show a fake init process | | Show a fake init process | ||
|- | |- | ||
| 5 | | style="text-align: right" | 5 | ||
| 0x00000020 | | style="font-family: monospace" | 0x00000020 | ||
| INFO_HIDE | | INFO_HIDE | ||
| X | | X | ||
| Hide context information in task status | | Hide context information in task status | ||
|- | |- | ||
| 6 | | style="text-align: right" | 6 | ||
| 0x00000040 | | style="font-family: monospace" | 0x00000040 | ||
| INFO_ULIMIT | | INFO_ULIMIT | ||
| L | | L | ||
| Apply ulimits to context | | Apply ulimits to context | ||
|- | |- | ||
| 7 | | style="text-align: right" | 7 | ||
| 0x00000080 | | style="font-family: monospace" | 0x00000080 | ||
| INFO_NSPACE | | INFO_NSPACE | ||
| L | | L | ||
| Use private namespace | | Use private namespace | ||
|- | |- | ||
| 8 | | style="text-align: right" | 8 | ||
| 0x00000100 | | style="font-family: monospace" | 0x00000100 | ||
| SCHED_HARD | | SCHED_HARD | ||
| | | | ||
| Enable hard scheduler | | Enable hard scheduler | ||
|- | |- | ||
| 9 | | style="text-align: right" | 9 | ||
| 0x00000200 | | style="font-family: monospace" | 0x00000200 | ||
| SCHED_PRIO | | SCHED_PRIO | ||
| | | | ||
| Enable priority scheduler | | Enable priority scheduler | ||
|- | |- | ||
| 10 | | style="text-align: right" | 10 | ||
| 0x00000400 | | style="font-family: monospace" | 0x00000400 | ||
| SCHED_PAUSE | | SCHED_PAUSE | ||
| | | | ||
| Pause context (unschedule) | | Pause context (unschedule) | ||
|- | |- | ||
| 20 | | style="text-align: right" | 20 | ||
| 0x00010000 | | style="font-family: monospace" | 0x00010000 | ||
| VIRT_MEM | | VIRT_MEM | ||
| | | | ||
| Virtualize memory information | | Virtualize memory information | ||
|- | |- | ||
| 21 | | style="text-align: right" | 21 | ||
| 0x00020000 | | style="font-family: monospace" | 0x00020000 | ||
| VIRT_UPTIME | | VIRT_UPTIME | ||
| | | | ||
| Virtualize uptime information | | Virtualize uptime information | ||
|- | |- | ||
| 22 | | style="text-align: right" | 22 | ||
| 0x00040000 | | style="font-family: monospace" | 0x00040000 | ||
| VIRT_CPU | | VIRT_CPU | ||
| | | | ||
| Virtualize cpu usage information | | Virtualize cpu usage information | ||
|- | |- | ||
| 23 | | style="text-align: right" | 23 | ||
| 0x00080000 | | style="font-family: monospace" | 0x00080000 | ||
| VIRT_LOAD | | VIRT_LOAD | ||
| | | | ||
| Virtualize load average information | | Virtualize load average information | ||
|- | |- | ||
| 24 | | style="text-align: right" | 24 | ||
| 0x00100000 | | style="font-family: monospace" | 0x00100000 | ||
| VIRT_TIME | | VIRT_TIME | ||
| | | | ||
| Allow per guest time offsets | | Allow per guest time offsets | ||
|- | |- | ||
| 28 | | style="text-align: right" | 28 | ||
| 0x01000000 | | style="font-family: monospace" | 0x01000000 | ||
| HIDE_MOUNT | | HIDE_MOUNT | ||
| | | | ||
| Hide entries in /proc/$pid/mounts | | Hide entries in /proc/$pid/mounts | ||
|- | |- | ||
| 29 | | style="text-align: right" | 29 | ||
| 0x02000000 | | style="font-family: monospace" | 0x02000000 | ||
| HIDE_NETIF | | HIDE_NETIF | ||
| | | | ||
| Hide foreign network interfaces | | Hide foreign network interfaces | ||
|- | |- | ||
| 30 | | style="text-align: right" | 30 | ||
| 0x04000000 | | style="font-family: monospace" | 0x04000000 | ||
| HIDE_VINFO | | HIDE_VINFO | ||
| | | | ||
| Hide context information in task status | | Hide context information in task status | ||
|- | |- | ||
| 32 | | style="text-align: right" | 32 | ||
| | | style="font-family: monospace" | 0x0001<<32 | ||
| STATE_SETUP | | STATE_SETUP | ||
| IO | | IO | ||
| Enable setup state | | Enable setup state | ||
|- | |- | ||
| 33 | | style="text-align: right" | 33 | ||
| | | style="font-family: monospace" | 0x0001<<33 | ||
| STATE_INIT | | STATE_INIT | ||
| IO | | IO | ||
| Enable init state | | Enable init state | ||
|- | |- | ||
| 34 | | style="text-align: right" | 34 | ||
| | | style="font-family: monospace" | 0x0001<<34 | ||
| STATE_ADMIN | | STATE_ADMIN | ||
| O | | O | ||
| Enable admin state | | Enable admin state | ||
|- | |- | ||
| 36 | | style="text-align: right" | 36 | ||
| | | style="font-family: monospace" | 0x0001<<36 | ||
| SC_HELPER | | SC_HELPER | ||
| I | | I | ||
| Enable state change helper | | Enable state change helper | ||
|- | |- | ||
| 37 | | style="text-align: right" | 37 | ||
| | | style="font-family: monospace" | 0x0001<<37 | ||
| REBOOT_KILL | | REBOOT_KILL | ||
| | | | ||
| Kill all processes on reboot(2) | | Kill all processes on reboot(2) | ||
|- | |- | ||
| 38 | | style="text-align: right" | 38 | ||
| | | style="font-family: monospace" | 0x0001<<38 | ||
| PERSISTENT | | PERSISTENT | ||
| | | | ||
| Make context persistent | | Make context persistent | ||
|- | |- | ||
| | | style="text-align: right" | 48 | ||
| | | style="font-family: monospace" | 0x0001<<48 | ||
| FORK_RSS | | FORK_RSS | ||
| | | | ||
| Block fork when RSS limit is exceeded | | Block fork when RSS limit is exceeded | ||
|- | |- | ||
| | | style="text-align: right" | 49 | ||
| | | style="font-family: monospace" | 0x0001<<49 | ||
| PROLIFIC | | PROLIFIC | ||
| | | | ||
| Allow context to create new contexts | | Allow context to create new contexts | ||
|- | |- | ||
| | | style="text-align: right" | 52 | ||
| | | style="font-family: monospace" | 0x0001<<52 | ||
| IGNEG_NICE | | IGNEG_NICE | ||
| | | | ||
| Line 297: | Line 297: | ||
! Description | ! Description | ||
|- | |- | ||
| 0 | | style="text-align: right" | 0 | ||
| 0x00000001 | | style="font-family: monospace" | 0x00000001 | ||
| INFO_LOCK | | INFO_LOCK | ||
| | | | ||
| Prohibit further context migration | | Prohibit further context migration | ||
|- | |- | ||
| 8 | | style="text-align: right" | 8 | ||
| 0x00000100 | | style="font-family: monospace" | 0x00000100 | ||
| SINGLE_IP | | SINGLE_IP | ||
| | | | ||
| Enable special handling of network contexts with a single IP only | | Enable special handling of network contexts with a single IP only | ||
|- | |- | ||
| 29 | | style="text-align: right" | 29 | ||
| 0x02000000 | | style="font-family: monospace" | 0x02000000 | ||
| HIDE_NETIF | | HIDE_NETIF | ||
| | | | ||
| Hide foreign network interfaces | | Hide foreign network interfaces | ||
|- | |- | ||
| 32 | | style="text-align: right" | 32 | ||
| | | style="font-family: monospace" | 0x0001<<32 | ||
| STATE_SETUP | | STATE_SETUP | ||
| | | IO | ||
| Enable setup state | | Enable setup state | ||
|- | |- | ||
| 34 | | style="text-align: right" | 34 | ||
| | | style="font-family: monospace" | 0x0001<<34 | ||
| STATE_ADMIN | | STATE_ADMIN | ||
| O | | O | ||
| Enable admin state | | Enable admin state | ||
|- | |- | ||
| 36 | | style="text-align: right" | 36 | ||
| | | style="font-family: monospace" | 0x0001<<36 | ||
| SC_HELPER | | SC_HELPER | ||
| I | | I | ||
| Enable state change helper | | Enable state change helper | ||
|- | |- | ||
| 38 | | style="text-align: right" | 38 | ||
| | | style="font-family: monospace" | 0x0001<<38 | ||
| PERSISTENT | | PERSISTENT | ||
| | | | ||
| Line 350: | Line 350: | ||
! Description | ! Description | ||
|- | |- | ||
| 0 | | style="text-align: right" | 0 | ||
| 0x00000001 | | style="font-family: monospace" | 0x00000001 | ||
| CHOWN | | CHOWN | ||
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership. | | In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership. | ||
|- | |- | ||
| 1 | | style="text-align: right" | 1 | ||
| 0x00000002 | | style="font-family: monospace" | 0x00000002 | ||
| DAC_OVERRIDE | | DAC_OVERRIDE | ||
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. | | Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. | ||
|- | |- | ||
| 2 | | style="text-align: right" | 2 | ||
| 0x00000004 | | style="font-family: monospace" | 0x00000004 | ||
| DAC_READ_SEARCH | | DAC_READ_SEARCH | ||
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. | | Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. | ||
|- | |- | ||
| 3 | | style="text-align: right" | 3 | ||
| 0x00000008 | | style="font-family: monospace" | 0x00000008 | ||
| FOWNER | | FOWNER | ||
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions. | | Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions. | ||
|- | |- | ||
| 4 | | style="text-align: right" | 4 | ||
| 0x00000010 | | style="font-family: monospace" | 0x00000010 | ||
| FSETID | | FSETID | ||
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented). | | Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented). | ||
|- | |- | ||
| 5 | | style="text-align: right" | 5 | ||
| 0x00000020 | | style="font-family: monospace" | 0x00000020 | ||
| KILL | | KILL | ||
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. | | Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. | ||
|- | |- | ||
| 6 | | style="text-align: right" | 6 | ||
| 0x00000040 | | style="font-family: monospace" | 0x00000040 | ||
| SETGID | | SETGID | ||
| | | | ||
| Line 388: | Line 388: | ||
* Allows forged gids on socket credentials passing. | * Allows forged gids on socket credentials passing. | ||
|- | |- | ||
| 7 | | style="text-align: right" | 7 | ||
| 0x00000080 | | style="font-family: monospace" | 0x00000080 | ||
| SETUID | | SETUID | ||
| | | | ||
| Line 395: | Line 395: | ||
* Allows forged pids on socket credentials passing. | * Allows forged pids on socket credentials passing. | ||
|- | |- | ||
| 8 | | style="text-align: right" | 8 | ||
| 0x00000100 | | style="font-family: monospace" | 0x00000100 | ||
| SETPCAP | | SETPCAP | ||
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid | | Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid | ||
|- | |- | ||
| 9 | | style="text-align: right" | 9 | ||
| 0x00000200 | | style="font-family: monospace" | 0x00000200 | ||
| LINUX_IMMUTABLE | | LINUX_IMMUTABLE | ||
| Allow modification of S_IMMUTABLE and S_APPEND file attributes | | Allow modification of S_IMMUTABLE and S_APPEND file attributes | ||
|- | |- | ||
| 10 | | style="text-align: right" | 10 | ||
| 0x00000400 | | style="font-family: monospace" | 0x00000400 | ||
| NET_BIND_SERVICE | | NET_BIND_SERVICE | ||
| | | | ||
| Line 412: | Line 412: | ||
* Allows binding to ATM VCIs below 32 | * Allows binding to ATM VCIs below 32 | ||
|- | |- | ||
| 11 | | style="text-align: right" | 11 | ||
| 0x00000800 | | style="font-family: monospace" | 0x00000800 | ||
| NET_BROADCAST | | NET_BROADCAST | ||
| Allow broadcasting, listen to multicast | | Allow broadcasting, listen to multicast | ||
|- | |- | ||
| 12 | | style="text-align: right" | 12 | ||
| 0x00001000 | | style="font-family: monospace" | 0x00001000 | ||
| NET_ADMIN | | NET_ADMIN | ||
| | | | ||
| Line 434: | Line 434: | ||
* Allow activation of ATM control sockets | * Allow activation of ATM control sockets | ||
|- | |- | ||
| 13 | | style="text-align: right" | 13 | ||
| 0x00002000 | | style="font-family: monospace" | 0x00002000 | ||
| NET_RAW | | NET_RAW | ||
| | | | ||
| Line 441: | Line 441: | ||
* Allow use of PACKET sockets | * Allow use of PACKET sockets | ||
|- | |- | ||
| 14 | | style="text-align: right" | 14 | ||
| 0x00004000 | | style="font-family: monospace" | 0x00004000 | ||
| IPC_LOCK | | IPC_LOCK | ||
| | | | ||
| Line 448: | Line 448: | ||
* Allow mlock and mlockall (which doesn't really have anything to do with IPC) | * Allow mlock and mlockall (which doesn't really have anything to do with IPC) | ||
|- | |- | ||
| 15 | | style="text-align: right" | 15 | ||
| 0x00008000 | | style="font-family: monospace" | 0x00008000 | ||
| IPC_OWNER | | IPC_OWNER | ||
| Override IPC ownership checks | | Override IPC ownership checks | ||
|- | |- | ||
| 16 | | style="text-align: right" | 16 | ||
| 0x00010000 | | style="font-family: monospace" | 0x00010000 | ||
| SYS_MODULE | | SYS_MODULE | ||
| | | | ||
| Line 460: | Line 460: | ||
* Modify cap_bset | * Modify cap_bset | ||
|- | |- | ||
| 17 | | style="text-align: right" | 17 | ||
| 0x00020000 | | style="font-family: monospace" | 0x00020000 | ||
| SYS_RAWIO | | SYS_RAWIO | ||
| | | | ||
| Line 467: | Line 467: | ||
* Allow sending USB messages to any device via /proc/bus/usb | * Allow sending USB messages to any device via /proc/bus/usb | ||
|- | |- | ||
| 18 | | style="text-align: right" | 18 | ||
| 0x00040000 | | style="font-family: monospace" | 0x00040000 | ||
| SYS_CHROOT | | SYS_CHROOT | ||
| | | Allow use of chroot() | ||
|- | |- | ||
| 19 | | style="text-align: right" | 19 | ||
| 0x00080000 | | style="font-family: monospace" | 0x00080000 | ||
| SYS_PTRACE | | SYS_PTRACE | ||
| Allow ptrace() of any process | | Allow ptrace() of any process | ||
|- | |- | ||
| 20 | | style="text-align: right" | 20 | ||
| 0x00100000 | | style="font-family: monospace" | 0x00100000 | ||
| SYS_PACCT | | SYS_PACCT | ||
| Allow configuration of process accounting | | Allow configuration of process accounting | ||
|- | |- | ||
| 21 | | style="text-align: right" | 21 | ||
| 0x00200000 | | style="font-family: monospace" | 0x00200000 | ||
| SYS_ADMIN | | SYS_ADMIN | ||
| | | | ||
| Line 520: | Line 520: | ||
* Allow setting zone reclaim policy | * Allow setting zone reclaim policy | ||
|- | |- | ||
| 22 | | style="text-align: right" | 22 | ||
| 0x00400000 | | style="font-family: monospace" | 0x00400000 | ||
| SYS_BOOT | | SYS_BOOT | ||
| Allow use of reboot() | | Allow use of reboot() | ||
|- | |- | ||
| 23 | | style="text-align: right" | 23 | ||
| 0x00800000 | | style="font-family: monospace" | 0x00800000 | ||
| SYS_NICE | | SYS_NICE | ||
| | | | ||
| Line 533: | Line 533: | ||
* Allow setting cpu affinity on other processes | * Allow setting cpu affinity on other processes | ||
|- | |- | ||
| 24 | | style="text-align: right" | 24 | ||
| 0x01000000 | | style="font-family: monospace" | 0x01000000 | ||
| SYS_RESOURCE | | SYS_RESOURCE | ||
| | | | ||
| Line 547: | Line 547: | ||
* Override max number of keymaps | * Override max number of keymaps | ||
|- | |- | ||
| 25 | | style="text-align: right" | 25 | ||
| 0x02000000 | | style="font-family: monospace" | 0x02000000 | ||
| SYS_TIME | | SYS_TIME | ||
| | | | ||
| Line 555: | Line 555: | ||
* Allow setting the real-time clock | * Allow setting the real-time clock | ||
|- | |- | ||
| 26 | | style="text-align: right" | 26 | ||
| 0x04000000 | | style="font-family: monospace" | 0x04000000 | ||
| SYS_TTY_CONFIG | | SYS_TTY_CONFIG | ||
| | | | ||
| Line 562: | Line 562: | ||
* Allow vhangup() of tty | * Allow vhangup() of tty | ||
|- | |- | ||
| 27 | | style="text-align: right" | 27 | ||
| 0x08000000 | | style="font-family: monospace" | 0x08000000 | ||
| MKNOD | | MKNOD | ||
| Allow the privileged aspects of mknod() | | Allow the privileged aspects of mknod() | ||
|- | |- | ||
| 28 | | style="text-align: right" | 28 | ||
| 0x10000000 | | style="font-family: monospace" | 0x10000000 | ||
| LEASE | | LEASE | ||
| Allow taking of leases on files | | Allow taking of leases on files | ||
|- | |- | ||
| 29 | | style="text-align: right" | 29 | ||
| 0x20000000 | | style="font-family: monospace" | 0x20000000 | ||
| AUDIT_WRITE | | AUDIT_WRITE | ||
| ?? | | ?? | ||
|- | |- | ||
| 30 | | style="text-align: right" | 30 | ||
| 0x40000000 | | style="font-family: monospace" | 0x40000000 | ||
| AUDIT_CONTROL | | AUDIT_CONTROL | ||
| ?? | | ?? | ||
|} | |} | ||
Revision as of 17:43, 22 October 2006
Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:
- Bit
- The bit number to enable the capability/flag
- Mask
- The bit number in hexadecimal notation
- Name
- Human readable identifier used in userspace utilities
- Tag
- Special capability/flag code to denote special behaviour, legacy usage and others (see below)
- Description
- Description of capability/flag effects
Special capability/flags codes
The tag column may contain one or more of the following tags:
| Tag | Description |
|---|---|
| I | Internal use only |
| L | Only supported with legacy enabled |
| O | One time capability/flag |
| U | Unsupported |
| X | Slightly different meaning in legacy |
Context capabilities (ccaps)
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | SET_UTSNAME | Allow setdomainname(2) and sethostname(2) | |
| 1 | 0x00000002 | SET_RLIMIT | Allow setrlimit(2) | |
| 8 | 0x00000100 | RAW_ICMP | Allow usage of raw ICMP sockets | |
| 12 | 0x00001000 | SYSLOG | Allow syslog(2) | |
| 16 | 0x00010000 | SECURE_MOUNT | Allow secure mount(2) | |
| 17 | 0x00020000 | SECURE_REMOUNT | Allow secure remount | |
| 18 | 0x00040000 | BINARY_MOUNT | Allow binary/network mounts | |
| 20 | 0x00100000 | QUOTA_CTL | Allow quota ioctls | |
| 21 | 0x00200000 | ADMIN_MAPPER | Allow access to device mapper | |
| 22 | 0x00400000 | ADMIN_CLOOP | Allow access to loop devices |
Context flags (cflags)
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | INFO_LOCK | L | Prohibit further context migration |
| 1 | 0x00000002 | INFO_SCHED | L | Account all processes as one |
| 2 | 0x00000004 | INFO_NPROC | L | Apply process limits to context |
| 3 | 0x00000008 | INFO_PRIVATE | L | Context cannot be entered |
| 4 | 0x00000010 | INFO_INIT | X | Show a fake init process |
| 5 | 0x00000020 | INFO_HIDE | X | Hide context information in task status |
| 6 | 0x00000040 | INFO_ULIMIT | L | Apply ulimits to context |
| 7 | 0x00000080 | INFO_NSPACE | L | Use private namespace |
| 8 | 0x00000100 | SCHED_HARD | Enable hard scheduler | |
| 9 | 0x00000200 | SCHED_PRIO | Enable priority scheduler | |
| 10 | 0x00000400 | SCHED_PAUSE | Pause context (unschedule) | |
| 20 | 0x00010000 | VIRT_MEM | Virtualize memory information | |
| 21 | 0x00020000 | VIRT_UPTIME | Virtualize uptime information | |
| 22 | 0x00040000 | VIRT_CPU | Virtualize cpu usage information | |
| 23 | 0x00080000 | VIRT_LOAD | Virtualize load average information | |
| 24 | 0x00100000 | VIRT_TIME | Allow per guest time offsets | |
| 28 | 0x01000000 | HIDE_MOUNT | Hide entries in /proc/$pid/mounts | |
| 29 | 0x02000000 | HIDE_NETIF | Hide foreign network interfaces | |
| 30 | 0x04000000 | HIDE_VINFO | Hide context information in task status | |
| 32 | 0x0001<<32 | STATE_SETUP | IO | Enable setup state |
| 33 | 0x0001<<33 | STATE_INIT | IO | Enable init state |
| 34 | 0x0001<<34 | STATE_ADMIN | O | Enable admin state |
| 36 | 0x0001<<36 | SC_HELPER | I | Enable state change helper |
| 37 | 0x0001<<37 | REBOOT_KILL | Kill all processes on reboot(2) | |
| 38 | 0x0001<<38 | PERSISTENT | Make context persistent | |
| 48 | 0x0001<<48 | FORK_RSS | Block fork when RSS limit is exceeded | |
| 49 | 0x0001<<49 | PROLIFIC | Allow context to create new contexts | |
| 52 | 0x0001<<52 | IGNEG_NICE | Ignore priority raise |
Network context flags (nflags)
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | INFO_LOCK | Prohibit further context migration | |
| 8 | 0x00000100 | SINGLE_IP | Enable special handling of network contexts with a single IP only | |
| 29 | 0x02000000 | HIDE_NETIF | Hide foreign network interfaces | |
| 32 | 0x0001<<32 | STATE_SETUP | IO | Enable setup state |
| 34 | 0x0001<<34 | STATE_ADMIN | O | Enable admin state |
| 36 | 0x0001<<36 | SC_HELPER | I | Enable state change helper |
| 38 | 0x0001<<38 | PERSISTENT | Make network context persistent |
System capabilities (bcaps)
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.
| Bit | Mask | Name | Description |
|---|---|---|---|
| 0 | 0x00000001 | CHOWN | In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership. |
| 1 | 0x00000002 | DAC_OVERRIDE | Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. |
| 2 | 0x00000004 | DAC_READ_SEARCH | Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. |
| 3 | 0x00000008 | FOWNER | Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions. |
| 4 | 0x00000010 | FSETID | Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented). |
| 5 | 0x00000020 | KILL | Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. |
| 6 | 0x00000040 | SETGID |
|
| 7 | 0x00000080 | SETUID |
|
| 8 | 0x00000100 | SETPCAP | Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid |
| 9 | 0x00000200 | LINUX_IMMUTABLE | Allow modification of S_IMMUTABLE and S_APPEND file attributes |
| 10 | 0x00000400 | NET_BIND_SERVICE |
|
| 11 | 0x00000800 | NET_BROADCAST | Allow broadcasting, listen to multicast |
| 12 | 0x00001000 | NET_ADMIN |
|
| 13 | 0x00002000 | NET_RAW |
|
| 14 | 0x00004000 | IPC_LOCK |
|
| 15 | 0x00008000 | IPC_OWNER | Override IPC ownership checks |
| 16 | 0x00010000 | SYS_MODULE |
|
| 17 | 0x00020000 | SYS_RAWIO |
|
| 18 | 0x00040000 | SYS_CHROOT | Allow use of chroot() |
| 19 | 0x00080000 | SYS_PTRACE | Allow ptrace() of any process |
| 20 | 0x00100000 | SYS_PACCT | Allow configuration of process accounting |
| 21 | 0x00200000 | SYS_ADMIN |
|
| 22 | 0x00400000 | SYS_BOOT | Allow use of reboot() |
| 23 | 0x00800000 | SYS_NICE |
|
| 24 | 0x01000000 | SYS_RESOURCE |
|
| 25 | 0x02000000 | SYS_TIME |
|
| 26 | 0x04000000 | SYS_TTY_CONFIG |
|
| 27 | 0x08000000 | MKNOD | Allow the privileged aspects of mknod() |
| 28 | 0x10000000 | LEASE | Allow taking of leases on files |
| 29 | 0x20000000 | AUDIT_WRITE | ?? |
| 30 | 0x40000000 | AUDIT_CONTROL | ?? |