Capabilities and Flags: Difference between revisions
imported>Hollow No edit summary |
imported>Hollow No edit summary |
||
| Line 1: | Line 1: | ||
__NOTOC__ | |||
Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information: | |||
The | ; Bit : The bit number to enable the capability/flag | ||
; Mask : The bit number in hexadecimal notation | |||
; Name : Human readable identifier used in userspace utilities | |||
; Tag : Special capability/flag code to denote special behaviour, legacy usage and others (see below) | |||
; Description : Description of capability/flag effects | |||
== Special capability/flags codes == | |||
The tag column may contain one or more of the following tags: | |||
{| class="wikitable_inline" | |||
! Tag | |||
! Description | |||
|- | |- | ||
| | | I | ||
| | | Internal use only | ||
|- | |- | ||
| | | L | ||
| | | Only supported with legacy enabled | ||
|- | |- | ||
| | | O | ||
| | | One time capability/flag | ||
|- | |- | ||
| | | U | ||
| | | Unsupported | ||
|- | |- | ||
| | | X | ||
| | | Slightly different meaning in legacy | ||
|} | |} | ||
| Line 322: | Line 37: | ||
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above. | The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above. | ||
{| class=" | {| class="wikitable_list" | ||
! Bit | ! Bit | ||
! Mask | ! Mask | ||
! Name | ! Name | ||
! Tag | |||
! Description | ! Description | ||
|- | |- | ||
| 0 | | 0 | ||
| 0x00000001 | | 0x00000001 | ||
| | | SET_UTSNAME | ||
| | | | ||
Allow setdomainname(2) and sethostname(2) | | Allow setdomainname(2) and sethostname(2) | ||
|- | |- | ||
| 1 | | 1 | ||
| 0x00000002 | | 0x00000002 | ||
| | | SET_RLIMIT | ||
| | | | ||
Allow setrlimit(2) | | Allow setrlimit(2) | ||
|- | |- | ||
| 8 | | 8 | ||
| 0x00000100 | | 0x00000100 | ||
| | | RAW_ICMP | ||
| | | | ||
Allow usage of raw ICMP sockets | | Allow usage of raw ICMP sockets | ||
|- | |- | ||
| 12 | | 12 | ||
| 0x00001000 | | 0x00001000 | ||
| | | SYSLOG | ||
| | | | ||
Allow syslog(2) | | Allow syslog(2) | ||
|- | |- | ||
| 16 | | 16 | ||
| 0x00010000 | | 0x00010000 | ||
| | | SECURE_MOUNT | ||
| | | | ||
Allow secure mount(2) | | Allow secure mount(2) | ||
|- | |- | ||
| 17 | | 17 | ||
| 0x00020000 | | 0x00020000 | ||
| | | SECURE_REMOUNT | ||
| | | | ||
Allow secure remount | | Allow secure remount | ||
|- | |- | ||
| 18 | | 18 | ||
| 0x00040000 | | 0x00040000 | ||
| | | BINARY_MOUNT | ||
| | | | ||
Allow binary/network mounts | | Allow binary/network mounts | ||
|- | |- | ||
| 20 | | 20 | ||
| 0x00100000 | | 0x00100000 | ||
| | | QUOTA_CTL | ||
| | | | ||
Allow quota ioctls | | Allow quota ioctls | ||
|- | |- | ||
| 21 | | 21 | ||
| 0x00200000 | | 0x00200000 | ||
| | | ADMIN_MAPPER | ||
| | | | ||
Allow access to device mapper | | Allow access to device mapper | ||
|- | |- | ||
| 22 | | 22 | ||
| 0x00400000 | | 0x00400000 | ||
| | | ADMIN_CLOOP | ||
| | | | ||
Allow access to loop devices | | Allow access to loop devices | ||
|} | |} | ||
| Line 393: | Line 109: | ||
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above. | The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above. | ||
{| class=" | {| class="wikitable_list" | ||
! Bit | ! Bit | ||
! Mask | ! Mask | ||
! Name | ! Name | ||
! Tag | |||
! Description | ! Description | ||
|- | |- | ||
| 0 | | 0 | ||
| 0x00000001 | | 0x00000001 | ||
| | | INFO_LOCK | ||
| | | L | ||
Prohibit further context migration | | Prohibit further context migration | ||
|- | |- | ||
| 1 | | 1 | ||
| 0x00000002 | | 0x00000002 | ||
| | | INFO_SCHED | ||
| | | L | ||
Account all processes as one | | Account all processes as one | ||
|- | |- | ||
| 2 | | 2 | ||
| 0x00000004 | | 0x00000004 | ||
| | | INFO_NPROC | ||
| | | L | ||
Apply process limits to context | | Apply process limits to context | ||
|- | |- | ||
| 3 | | 3 | ||
| 0x00000008 | | 0x00000008 | ||
| | | INFO_PRIVATE | ||
| | | L | ||
Context cannot be entered | | Context cannot be entered | ||
|- | |- | ||
| 4 | | 4 | ||
| 0x00000010 | | 0x00000010 | ||
| | | INFO_INIT | ||
| | | X | ||
Show a fake init process | | Show a fake init process | ||
|- | |- | ||
| 5 | | 5 | ||
| 0x00000020 | | 0x00000020 | ||
| | | INFO_HIDE | ||
| | | X | ||
Hide context information in task status | | Hide context information in task status | ||
|- | |- | ||
| 6 | | 6 | ||
| 0x00000040 | | 0x00000040 | ||
| | | INFO_ULIMIT | ||
| | | L | ||
Apply ulimits to context | | Apply ulimits to context | ||
|- | |- | ||
| 7 | | 7 | ||
| 0x00000080 | | 0x00000080 | ||
| | | INFO_NSPACE | ||
| | | L | ||
Use private namespace | | Use private namespace | ||
|- | |- | ||
| 8 | | 8 | ||
| 0x00000100 | | 0x00000100 | ||
| | | SCHED_HARD | ||
| | | | ||
Enable hard scheduler | | Enable hard scheduler | ||
|- | |- | ||
| 9 | | 9 | ||
| 0x00000200 | | 0x00000200 | ||
| | | SCHED_PRIO | ||
| | | | ||
Enable priority scheduler | | Enable priority scheduler | ||
|- | |- | ||
| 10 | | 10 | ||
| 0x00000400 | | 0x00000400 | ||
| | | SCHED_PAUSE | ||
| | | | ||
Pause context (unschedule) | | Pause context (unschedule) | ||
|- | |- | ||
| 20 | | 20 | ||
| 0x00010000 | | 0x00010000 | ||
| | | VIRT_MEM | ||
| | | | ||
Virtualize memory information | | Virtualize memory information | ||
|- | |- | ||
| 21 | | 21 | ||
| 0x00020000 | | 0x00020000 | ||
| | | VIRT_UPTIME | ||
| | | | ||
Virtualize uptime information | | Virtualize uptime information | ||
|- | |- | ||
| 22 | | 22 | ||
| 0x00040000 | | 0x00040000 | ||
| | | VIRT_CPU | ||
| | | | ||
Virtualize cpu usage information | | Virtualize cpu usage information | ||
|- | |- | ||
| 23 | | 23 | ||
| 0x00080000 | | 0x00080000 | ||
| | | VIRT_LOAD | ||
| | | | ||
Virtualize load average information | | Virtualize load average information | ||
|- | |- | ||
| 24 | | 24 | ||
| 0x00100000 | | 0x00100000 | ||
| | | VIRT_TIME | ||
| | | | ||
Allow per guest time offsets | | Allow per guest time offsets | ||
|- | |- | ||
| 28 | | 28 | ||
| 0x01000000 | | 0x01000000 | ||
| | | HIDE_MOUNT | ||
| | | | ||
Hide entries in /proc/$pid/mounts | | Hide entries in /proc/$pid/mounts | ||
|- | |- | ||
| 29 | | 29 | ||
| 0x02000000 | | 0x02000000 | ||
| | | HIDE_NETIF | ||
| | | | ||
Hide foreign network interfaces | | Hide foreign network interfaces | ||
|- | |- | ||
| 30 | | 30 | ||
| 0x04000000 | | 0x04000000 | ||
| | | HIDE_VINFO | ||
| | | | ||
Hide context information in task status | | Hide context information in task status | ||
|- | |- | ||
| 32 | | 32 | ||
| (1ULL<<32) | | (1ULL<<32) | ||
| | | STATE_SETUP | ||
| | | IO | ||
Enable setup state | | Enable setup state | ||
|- | |- | ||
| 33 | | 33 | ||
| (1ULL<<33) | | (1ULL<<33) | ||
| | | STATE_INIT | ||
| | | IO | ||
Enable init state | | Enable init state | ||
|- | |- | ||
| 34 | | 34 | ||
| (1ULL<<34) | | (1ULL<<34) | ||
| | | STATE_ADMIN | ||
| | | O | ||
Enable admin state | | Enable admin state | ||
|- | |- | ||
| 36 | | 36 | ||
| (1ULL<<36) | | (1ULL<<36) | ||
| | | SC_HELPER | ||
| | | I | ||
Enable state change helper | | Enable state change helper | ||
|- | |- | ||
| 37 | | 37 | ||
| (1ULL<<37) | | (1ULL<<37) | ||
| | | REBOOT_KILL | ||
| | | | ||
Kill all processes on reboot(2) | | Kill all processes on reboot(2) | ||
|- | |- | ||
| 38 | | 38 | ||
| (1ULL<<38) | | (1ULL<<38) | ||
| | | PERSISTENT | ||
| | | | ||
Make context persistent | | Make context persistent | ||
|- | |- | ||
| 0 | | 0 | ||
| (1ULL<<48) | | (1ULL<<48) | ||
| | | FORK_RSS | ||
| | | | ||
Block fork when RSS limit is exceeded | | Block fork when RSS limit is exceeded | ||
|- | |- | ||
| 0 | | 0 | ||
| (1ULL<<49) | | (1ULL<<49) | ||
| | | PROLIFIC | ||
| | | | ||
Allow context to create new contexts | | Allow context to create new contexts | ||
|- | |- | ||
| 0 | | 0 | ||
| (1ULL<<52) | | (1ULL<<52) | ||
| | | IGNEG_NICE | ||
| | | | ||
Ignore priority raise | | Ignore priority raise | ||
|} | |} | ||
| Line 573: | Line 290: | ||
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above. | The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above. | ||
{| class=" | {| class="wikitable_list" | ||
! Bit | ! Bit | ||
! Mask | ! Mask | ||
! Name | ! Name | ||
! Tag | |||
! Description | ! Description | ||
|- | |- | ||
| 0 | | 0 | ||
| 0x00000001 | | 0x00000001 | ||
| | | INFO_LOCK | ||
| | | | ||
Prohibit further context migration | | Prohibit further context migration | ||
|- | |||
| 8 | |||
| 0x00000100 | |||
| SINGLE_IP | |||
| | |||
| Enable special handling of network contexts with a single IP only | |||
|- | |||
| 29 | |||
| 0x02000000 | |||
| HIDE_NETIF | |||
| | |||
| Hide foreign network interfaces | |||
|- | |- | ||
| 32 | | 32 | ||
| (1ULL<<32) | | (1ULL<<32) | ||
| | | STATE_SETUP | ||
| | | OI | ||
Enable setup state | | Enable setup state | ||
|- | |- | ||
| 34 | | 34 | ||
| (1ULL<<34) | | (1ULL<<34) | ||
| | | STATE_ADMIN | ||
| | | O | ||
Enable admin state | | Enable admin state | ||
|- | |- | ||
| 36 | | 36 | ||
| (1ULL<<36) | | (1ULL<<36) | ||
| | | SC_HELPER | ||
| | | I | ||
Enable state change helper | | Enable state change helper | ||
|- | |- | ||
| 38 | | 38 | ||
| (1ULL<<38) | | (1ULL<<38) | ||
| | | PERSISTENT | ||
| | |||
| Make network context persistent | |||
|} | |||
== System capabilities (bcaps) == | |||
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel. | |||
{| class="wikitable_list" | |||
! Bit | |||
! Mask | |||
! Name | |||
! Description | |||
|- | |||
| 0 | |||
| 0x00000001 | |||
| CHOWN | |||
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership. | |||
|- | |||
| 1 | |||
| 0x00000002 | |||
| DAC_OVERRIDE | |||
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. | |||
|- | |||
| 2 | |||
| 0x00000004 | |||
| DAC_READ_SEARCH | |||
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. | |||
|- | |||
| 3 | |||
| 0x00000008 | |||
| FOWNER | |||
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions. | |||
|- | |||
| 4 | |||
| 0x00000010 | |||
| FSETID | |||
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented). | |||
|- | |||
| 5 | |||
| 0x00000020 | |||
| KILL | |||
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. | |||
|- | |||
| 6 | |||
| 0x00000040 | |||
| SETGID | |||
| | |||
* Allows setgid(2) manipulation | |||
* Allows setgroups(2) | |||
* Allows forged gids on socket credentials passing. | |||
|- | |||
| 7 | |||
| 0x00000080 | |||
| SETUID | |||
| | |||
* Allows set*uid(2) manipulation (including fsuid). | |||
* Allows forged pids on socket credentials passing. | |||
|- | |||
| 8 | |||
| 0x00000100 | |||
| SETPCAP | |||
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid | |||
|- | |||
| 9 | |||
| 0x00000200 | |||
| LINUX_IMMUTABLE | |||
| Allow modification of S_IMMUTABLE and S_APPEND file attributes | |||
|- | |||
| 10 | |||
| 0x00000400 | |||
| NET_BIND_SERVICE | |||
| | |||
* Allows binding to TCP/UDP sockets below 1024 | |||
* Allows binding to ATM VCIs below 32 | |||
|- | |||
| 11 | |||
| 0x00000800 | |||
| NET_BROADCAST | |||
| Allow broadcasting, listen to multicast | |||
|- | |||
| 12 | |||
| 0x00001000 | |||
| NET_ADMIN | |||
| | | | ||
* Allow interface configuration | |||
* Allow administration of IP firewall, masquerading and accounting | |||
* Allow setting debug option on sockets | |||
* Allow modification of routing tables | |||
* Allow setting arbitrary process / process group ownership on sockets | |||
* Allow binding to any address for transparent proxying | |||
* Allow setting TOS (type of service) | |||
* Allow setting promiscuous mode | |||
* Allow clearing driver statistics | |||
* Allow multicasting | |||
* Allow read/write of device-specific registers | |||
* Allow activation of ATM control sockets | |||
|- | |||
| 13 | |||
| 0x00002000 | |||
| NET_RAW | |||
| | |||
* Allow use of RAW sockets | |||
* Allow use of PACKET sockets | |||
|- | |||
| 14 | |||
| 0x00004000 | |||
| IPC_LOCK | |||
| | |||
* Allow locking of shared memory segments | |||
* Allow mlock and mlockall (which doesn't really have anything to do with IPC) | |||
|- | |||
| 15 | |||
| 0x00008000 | |||
| IPC_OWNER | |||
| Override IPC ownership checks | |||
|- | |||
| 16 | |||
| 0x00010000 | |||
| SYS_MODULE | |||
| | |||
* Insert and remove kernel modules - modify kernel without limit | |||
* Modify cap_bset | |||
|- | |||
| 17 | |||
| 0x00020000 | |||
| SYS_RAWIO | |||
| | |||
* Allow ioperm/iopl access | |||
* Allow sending USB messages to any device via /proc/bus/usb | |||
|- | |||
| 18 | |||
| 0x00040000 | |||
| SYS_CHROOT | |||
| * Allow use of chroot() | |||
|- | |||
| 19 | |||
| 0x00080000 | |||
| SYS_PTRACE | |||
| Allow ptrace() of any process | |||
|- | |||
| 20 | |||
| 0x00100000 | |||
| SYS_PACCT | |||
| Allow configuration of process accounting | |||
|- | |||
| 21 | |||
| 0x00200000 | |||
| SYS_ADMIN | |||
| | |||
* Allow configuration of the secure attention key | |||
* Allow administration of the random device | |||
* Allow examination and configuration of disk quotas | |||
* Allow configuring the kernel's syslog (printk behaviour) | |||
* Allow setting the domainname | |||
* Allow setting the hostname | |||
* Allow calling bdflush() | |||
* Allow mount() and umount(), setting up new smb connection | |||
* Allow some autofs root ioctls | |||
* Allow nfsservctl | |||
* Allow VM86_REQUEST_IRQ | |||
* Allow to read/write pci config on alpha | |||
* Allow irix_prctl on mips (setstacksize) | |||
* Allow flushing all cache on m68k (sys_cacheflush) | |||
* Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory) | |||
* Allow locking/unlocking of shared memory segment | |||
* Allow turning swap on/off | |||
* Allow forged pids on socket credentials passing | |||
* Allow setting readahead and flushing buffers on block devices | |||
* Allow setting geometry in floppy driver | |||
* Allow turning DMA on/off in xd driver | |||
* Allow administration of md devices (mostly the above, but some extra ioctls) | |||
* Allow tuning the ide driver | |||
* Allow access to the nvram device | |||
* Allow administration of apm_bios, serial and bttv (TV) device | |||
* Allow manufacturer commands in isdn CAPI support driver | |||
* Allow reading non-standardized portions of pci configuration space | |||
* Allow DDI debug ioctl on sbpcd driver | |||
* Allow setting up serial ports | |||
* Allow sending raw qic-117 commands | |||
* Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands | |||
* Allow setting encryption key on loopback filesystem | |||
* Allow setting zone reclaim policy | |||
|- | |||
| 22 | |||
| 0x00400000 | |||
| SYS_BOOT | |||
| Allow use of reboot() | |||
|- | |||
| 23 | |||
| 0x00800000 | |||
| SYS_NICE | |||
| | |||
* Allow raising priority and setting priority on other (different UID) processes | |||
* Allow use of FIFO and round-robin (realtime) scheduling on own processes and setting the scheduling algorithm used by another process. | |||
* Allow setting cpu affinity on other processes | |||
|- | |||
| 24 | |||
| 0x01000000 | |||
| SYS_RESOURCE | |||
| | |||
* Override resource limits. Set resource limits. | |||
* Override quota limits. | |||
* Override reserved space on ext2 filesystem | |||
* Modify data journaling mode on ext3 filesystem (uses journaling resources) | |||
* ''NOTE:'' ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too | |||
* Override size restrictions on IPC message queues | |||
* Allow more than 64hz interrupts from the real-time clock | |||
* Override max number of consoles on console allocation | |||
* Override max number of keymaps | |||
|- | |||
| 25 | |||
| 0x02000000 | |||
| SYS_TIME | |||
| | |||
* Allow manipulation of system clock | |||
* Allow irix_stime on mips | |||
* Allow setting the real-time clock | |||
|- | |||
| 26 | |||
| 0x04000000 | |||
| SYS_TTY_CONFIG | |||
| | |||
* Allow configuration of tty devices | |||
* Allow vhangup() of tty | |||
|- | |||
| 27 | |||
| 0x08000000 | |||
| MKNOD | |||
| Allow the privileged aspects of mknod() | |||
|- | |||
| 28 | |||
| 0x10000000 | |||
| LEASE | |||
| Allow taking of leases on files | |||
|- | |||
| 29 | |||
| 0x20000000 | |||
| AUDIT_WRITE | |||
| ?? | |||
|- | |||
| 30 | |||
| 0x40000000 | |||
| AUDIT_CONTROL | |||
| ?? | |||
|} | |} | ||
Revision as of 17:08, 22 October 2006
Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:
- Bit
- The bit number to enable the capability/flag
- Mask
- The bit number in hexadecimal notation
- Name
- Human readable identifier used in userspace utilities
- Tag
- Special capability/flag code to denote special behaviour, legacy usage and others (see below)
- Description
- Description of capability/flag effects
Special capability/flags codes
The tag column may contain one or more of the following tags:
| Tag | Description |
|---|---|
| I | Internal use only |
| L | Only supported with legacy enabled |
| O | One time capability/flag |
| U | Unsupported |
| X | Slightly different meaning in legacy |
Context capabilities (ccaps)
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | SET_UTSNAME | Allow setdomainname(2) and sethostname(2) | |
| 1 | 0x00000002 | SET_RLIMIT | Allow setrlimit(2) | |
| 8 | 0x00000100 | RAW_ICMP | Allow usage of raw ICMP sockets | |
| 12 | 0x00001000 | SYSLOG | Allow syslog(2) | |
| 16 | 0x00010000 | SECURE_MOUNT | Allow secure mount(2) | |
| 17 | 0x00020000 | SECURE_REMOUNT | Allow secure remount | |
| 18 | 0x00040000 | BINARY_MOUNT | Allow binary/network mounts | |
| 20 | 0x00100000 | QUOTA_CTL | Allow quota ioctls | |
| 21 | 0x00200000 | ADMIN_MAPPER | Allow access to device mapper | |
| 22 | 0x00400000 | ADMIN_CLOOP | Allow access to loop devices |
Context flags (cflags)
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | INFO_LOCK | L | Prohibit further context migration |
| 1 | 0x00000002 | INFO_SCHED | L | Account all processes as one |
| 2 | 0x00000004 | INFO_NPROC | L | Apply process limits to context |
| 3 | 0x00000008 | INFO_PRIVATE | L | Context cannot be entered |
| 4 | 0x00000010 | INFO_INIT | X | Show a fake init process |
| 5 | 0x00000020 | INFO_HIDE | X | Hide context information in task status |
| 6 | 0x00000040 | INFO_ULIMIT | L | Apply ulimits to context |
| 7 | 0x00000080 | INFO_NSPACE | L | Use private namespace |
| 8 | 0x00000100 | SCHED_HARD | Enable hard scheduler | |
| 9 | 0x00000200 | SCHED_PRIO | Enable priority scheduler | |
| 10 | 0x00000400 | SCHED_PAUSE | Pause context (unschedule) | |
| 20 | 0x00010000 | VIRT_MEM | Virtualize memory information | |
| 21 | 0x00020000 | VIRT_UPTIME | Virtualize uptime information | |
| 22 | 0x00040000 | VIRT_CPU | Virtualize cpu usage information | |
| 23 | 0x00080000 | VIRT_LOAD | Virtualize load average information | |
| 24 | 0x00100000 | VIRT_TIME | Allow per guest time offsets | |
| 28 | 0x01000000 | HIDE_MOUNT | Hide entries in /proc/$pid/mounts | |
| 29 | 0x02000000 | HIDE_NETIF | Hide foreign network interfaces | |
| 30 | 0x04000000 | HIDE_VINFO | Hide context information in task status | |
| 32 | (1ULL<<32) | STATE_SETUP | IO | Enable setup state |
| 33 | (1ULL<<33) | STATE_INIT | IO | Enable init state |
| 34 | (1ULL<<34) | STATE_ADMIN | O | Enable admin state |
| 36 | (1ULL<<36) | SC_HELPER | I | Enable state change helper |
| 37 | (1ULL<<37) | REBOOT_KILL | Kill all processes on reboot(2) | |
| 38 | (1ULL<<38) | PERSISTENT | Make context persistent | |
| 0 | (1ULL<<48) | FORK_RSS | Block fork when RSS limit is exceeded | |
| 0 | (1ULL<<49) | PROLIFIC | Allow context to create new contexts | |
| 0 | (1ULL<<52) | IGNEG_NICE | Ignore priority raise |
Network context flags (nflags)
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | INFO_LOCK | Prohibit further context migration | |
| 8 | 0x00000100 | SINGLE_IP | Enable special handling of network contexts with a single IP only | |
| 29 | 0x02000000 | HIDE_NETIF | Hide foreign network interfaces | |
| 32 | (1ULL<<32) | STATE_SETUP | OI | Enable setup state |
| 34 | (1ULL<<34) | STATE_ADMIN | O | Enable admin state |
| 36 | (1ULL<<36) | SC_HELPER | I | Enable state change helper |
| 38 | (1ULL<<38) | PERSISTENT | Make network context persistent |
System capabilities (bcaps)
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.
| Bit | Mask | Name | Description |
|---|---|---|---|
| 0 | 0x00000001 | CHOWN | In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership. |
| 1 | 0x00000002 | DAC_OVERRIDE | Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. |
| 2 | 0x00000004 | DAC_READ_SEARCH | Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. |
| 3 | 0x00000008 | FOWNER | Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions. |
| 4 | 0x00000010 | FSETID | Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented). |
| 5 | 0x00000020 | KILL | Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. |
| 6 | 0x00000040 | SETGID |
|
| 7 | 0x00000080 | SETUID |
|
| 8 | 0x00000100 | SETPCAP | Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid |
| 9 | 0x00000200 | LINUX_IMMUTABLE | Allow modification of S_IMMUTABLE and S_APPEND file attributes |
| 10 | 0x00000400 | NET_BIND_SERVICE |
|
| 11 | 0x00000800 | NET_BROADCAST | Allow broadcasting, listen to multicast |
| 12 | 0x00001000 | NET_ADMIN |
|
| 13 | 0x00002000 | NET_RAW |
|
| 14 | 0x00004000 | IPC_LOCK |
|
| 15 | 0x00008000 | IPC_OWNER | Override IPC ownership checks |
| 16 | 0x00010000 | SYS_MODULE |
|
| 17 | 0x00020000 | SYS_RAWIO |
|
| 18 | 0x00040000 | SYS_CHROOT | * Allow use of chroot() |
| 19 | 0x00080000 | SYS_PTRACE | Allow ptrace() of any process |
| 20 | 0x00100000 | SYS_PACCT | Allow configuration of process accounting |
| 21 | 0x00200000 | SYS_ADMIN |
|
| 22 | 0x00400000 | SYS_BOOT | Allow use of reboot() |
| 23 | 0x00800000 | SYS_NICE |
|
| 24 | 0x01000000 | SYS_RESOURCE |
|
| 25 | 0x02000000 | SYS_TIME |
|
| 26 | 0x04000000 | SYS_TTY_CONFIG |
|
| 27 | 0x08000000 | MKNOD | Allow the privileged aspects of mknod() |
| 28 | 0x10000000 | LEASE | Allow taking of leases on files |
| 29 | 0x20000000 | AUDIT_WRITE | ?? |
| 30 | 0x40000000 | AUDIT_CONTROL | ?? |