Capabilities and Flags
Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:
- Bit
- The bit number to enable the capability/flag
- Mask
- The bit number in hexadecimal notation
- Name
- Human readable identifier used in userspace utilities
- Tag
- Special capability/flag code to denote special behaviour, legacy usage and others (see below)
- Description
- Description of capability/flag effects
Special capability/flags codes
The tag column may contain one or more of the following tags:
| Tag | Description |
|---|---|
| I | Internal use only |
| L | Only supported with legacy enabled |
| O | One time capability/flag |
| U | Unsupported |
| X | Slightly different meaning in legacy |
Context capabilities (ccaps)
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | SET_UTSNAME | Allow setdomainname(2) and sethostname(2) | |
| 1 | 0x00000002 | SET_RLIMIT | Allow setrlimit(2) | |
| 8 | 0x00000100 | RAW_ICMP | Allow usage of raw ICMP sockets | |
| 12 | 0x00001000 | SYSLOG | Allow syslog(2) | |
| 16 | 0x00010000 | SECURE_MOUNT | Allow secure mount(2) | |
| 17 | 0x00020000 | SECURE_REMOUNT | Allow secure remount | |
| 18 | 0x00040000 | BINARY_MOUNT | Allow binary/network mounts | |
| 20 | 0x00100000 | QUOTA_CTL | Allow quota ioctls | |
| 21 | 0x00200000 | ADMIN_MAPPER | Allow access to device mapper | |
| 22 | 0x00400000 | ADMIN_CLOOP | Allow access to loop devices |
Context flags (cflags)
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | INFO_LOCK | L | Prohibit further context migration |
| 1 | 0x00000002 | INFO_SCHED | L | Account all processes as one |
| 2 | 0x00000004 | INFO_NPROC | L | Apply process limits to context |
| 3 | 0x00000008 | INFO_PRIVATE | L | Context cannot be entered |
| 4 | 0x00000010 | INFO_INIT | X | Show a fake init process |
| 5 | 0x00000020 | INFO_HIDE | X | Hide context information in task status |
| 6 | 0x00000040 | INFO_ULIMIT | L | Apply ulimits to context |
| 7 | 0x00000080 | INFO_NSPACE | L | Use private namespace |
| 8 | 0x00000100 | SCHED_HARD | Enable hard scheduler | |
| 9 | 0x00000200 | SCHED_PRIO | Enable priority scheduler | |
| 10 | 0x00000400 | SCHED_PAUSE | Pause context (unschedule) | |
| 20 | 0x00010000 | VIRT_MEM | Virtualize memory information | |
| 21 | 0x00020000 | VIRT_UPTIME | Virtualize uptime information | |
| 22 | 0x00040000 | VIRT_CPU | Virtualize cpu usage information | |
| 23 | 0x00080000 | VIRT_LOAD | Virtualize load average information | |
| 24 | 0x00100000 | VIRT_TIME | Allow per guest time offsets | |
| 28 | 0x01000000 | HIDE_MOUNT | Hide entries in /proc/$pid/mounts | |
| 29 | 0x02000000 | HIDE_NETIF | Hide foreign network interfaces | |
| 30 | 0x04000000 | HIDE_VINFO | Hide context information in task status | |
| 32 | (1ULL<<32) | STATE_SETUP | IO | Enable setup state |
| 33 | (1ULL<<33) | STATE_INIT | IO | Enable init state |
| 34 | (1ULL<<34) | STATE_ADMIN | O | Enable admin state |
| 36 | (1ULL<<36) | SC_HELPER | I | Enable state change helper |
| 37 | (1ULL<<37) | REBOOT_KILL | Kill all processes on reboot(2) | |
| 38 | (1ULL<<38) | PERSISTENT | Make context persistent | |
| 0 | (1ULL<<48) | FORK_RSS | Block fork when RSS limit is exceeded | |
| 0 | (1ULL<<49) | PROLIFIC | Allow context to create new contexts | |
| 0 | (1ULL<<52) | IGNEG_NICE | Ignore priority raise |
Network context flags (nflags)
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.
| Bit | Mask | Name | Tag | Description |
|---|---|---|---|---|
| 0 | 0x00000001 | INFO_LOCK | Prohibit further context migration | |
| 8 | 0x00000100 | SINGLE_IP | Enable special handling of network contexts with a single IP only | |
| 29 | 0x02000000 | HIDE_NETIF | Hide foreign network interfaces | |
| 32 | (1ULL<<32) | STATE_SETUP | OI | Enable setup state |
| 34 | (1ULL<<34) | STATE_ADMIN | O | Enable admin state |
| 36 | (1ULL<<36) | SC_HELPER | I | Enable state change helper |
| 38 | (1ULL<<38) | PERSISTENT | Make network context persistent |
System capabilities (bcaps)
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.
| Bit | Mask | Name | Description |
|---|---|---|---|
| 0 | 0x00000001 | CHOWN | In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership. |
| 1 | 0x00000002 | DAC_OVERRIDE | Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. |
| 2 | 0x00000004 | DAC_READ_SEARCH | Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. |
| 3 | 0x00000008 | FOWNER | Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions. |
| 4 | 0x00000010 | FSETID | Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented). |
| 5 | 0x00000020 | KILL | Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. |
| 6 | 0x00000040 | SETGID |
|
| 7 | 0x00000080 | SETUID |
|
| 8 | 0x00000100 | SETPCAP | Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid |
| 9 | 0x00000200 | LINUX_IMMUTABLE | Allow modification of S_IMMUTABLE and S_APPEND file attributes |
| 10 | 0x00000400 | NET_BIND_SERVICE |
|
| 11 | 0x00000800 | NET_BROADCAST | Allow broadcasting, listen to multicast |
| 12 | 0x00001000 | NET_ADMIN |
|
| 13 | 0x00002000 | NET_RAW |
|
| 14 | 0x00004000 | IPC_LOCK |
|
| 15 | 0x00008000 | IPC_OWNER | Override IPC ownership checks |
| 16 | 0x00010000 | SYS_MODULE |
|
| 17 | 0x00020000 | SYS_RAWIO |
|
| 18 | 0x00040000 | SYS_CHROOT | * Allow use of chroot() |
| 19 | 0x00080000 | SYS_PTRACE | Allow ptrace() of any process |
| 20 | 0x00100000 | SYS_PACCT | Allow configuration of process accounting |
| 21 | 0x00200000 | SYS_ADMIN |
|
| 22 | 0x00400000 | SYS_BOOT | Allow use of reboot() |
| 23 | 0x00800000 | SYS_NICE |
|
| 24 | 0x01000000 | SYS_RESOURCE |
|
| 25 | 0x02000000 | SYS_TIME |
|
| 26 | 0x04000000 | SYS_TTY_CONFIG |
|
| 27 | 0x08000000 | MKNOD | Allow the privileged aspects of mknod() |
| 28 | 0x10000000 | LEASE | Allow taking of leases on files |
| 29 | 0x20000000 | AUDIT_WRITE | ?? |
| 30 | 0x40000000 | AUDIT_CONTROL | ?? |