Capabilities and Flags
Below is a list of capabilities and flags used for contexts and processes within.
System capabilities (bcaps)
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.
| Bit | Mask | Name | Description |
|---|---|---|---|
| 0 | 0x00000001 | CAP_CHOWN |
In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership. |
| 1 | 0x00000002 | CAP_DAC_OVERRIDE |
Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. |
| 2 | 0x00000004 | CAP_DAC_READ_SEARCH |
Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. |
| 3 | 0x00000008 | CAP_FOWNER |
Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions. |
| 4 | 0x00000010 | CAP_FSETID |
Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented). |
| 5 | 0x00000020 | CAP_KILL |
Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. |
| 6 | 0x00000040 | CAP_SETGID |
Allows setgid(2) manipulation |
| 7 | 0x00000080 | CAP_SETUID |
Allows set*uid(2) manipulation (including fsuid). |
| 8 | 0x00000100 | CAP_SETPCAP |
Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid |
| 9 | 0x00000200 | CAP_LINUX_IMMUTABLE |
Allow modification of S_IMMUTABLE and S_APPEND file attributes |
| 10 | 0x00000400 | CAP_NET_BIND_SERVICE |
Allows binding to TCP/UDP sockets below 1024 |
| 11 | 0x00000800 | CAP_NET_BROADCAST |
Allow broadcasting, listen to multicast |
| 12 | 0x00001000 | CAP_NET_ADMIN |
Allow interface configuration |
| 13 | 0x00002000 | CAP_NET_RAW |
Allow use of RAW sockets |
| 14 | 0x00004000 | CAP_IPC_LOCK |
Allow locking of shared memory segments |
| 15 | 0x00008000 | CAP_IPC_OWNER |
Override IPC ownership checks |
| 16 | 0x00010000 | CAP_SYS_MODULE |
Insert and remove kernel modules - modify kernel without limit |
| 17 | 0x00020000 | CAP_SYS_RAWIO |
Allow ioperm/iopl access |
| 18 | 0x00040000 | CAP_SYS_CHROOT |
Allow use of chroot() |
| 19 | 0x00080000 | CAP_SYS_PTRACE |
Allow ptrace() of any process |
| 20 | 0x00100000 | CAP_SYS_PACCT |
Allow configuration of process accounting |
| 21 | 0x00200000 | CAP_SYS_ADMIN |
Allow configuration of the secure attention key |
| 22 | 0x00400000 | CAP_SYS_BOOT |
Allow use of reboot() |
| 23 | 0x00800000 | CAP_SYS_NICE |
Allow raising priority and setting priority on other (different
UID) processes |
| 24 | 0x01000000 | CAP_SYS_RESOURCE |
Override resource limits. Set resource limits. |
| 25 | 0x02000000 | CAP_SYS_TIME |
Allow manipulation of system clock |
| 26 | 0x04000000 | CAP_SYS_TTY_CONFIG |
Allow configuration of tty devices |
| 27 | 0x08000000 | CAP_MKNOD |
Allow the privileged aspects of mknod() |
| 28 | 0x10000000 | CAP_LEASE |
Allow taking of leases on files |
| 29 | 0x20000000 | CAP_AUDIT_WRITE |
?? |
| 30 | 0x40000000 | CAP_AUDIT_CONTROL |
?? |
Context capabilities (ccaps)
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.
| Bit | Mask | Name | Description |
|---|---|---|---|
| 0 | 0x00000001 | VXC_SET_UTSNAME |
Allow setdomainname(2) and sethostname(2) |
| 1 | 0x00000002 | VXC_SET_RLIMIT |
Allow setrlimit(2) |
| 8 | 0x00000100 | VXC_RAW_ICMP |
Allow usage of raw ICMP sockets |
| 12 | 0x00001000 | VXC_SYSLOG |
Allow syslog(2) |
| 16 | 0x00010000 | VXC_SECURE_MOUNT |
Allow secure mount(2) |
| 17 | 0x00020000 | VXC_SECURE_REMOUNT |
Allow secure remount |
| 18 | 0x00040000 | VXC_BINARY_MOUNT |
Allow binary/network mounts |
| 20 | 0x00100000 | VXC_QUOTA_CTL |
Allow quota ioctls |
| 21 | 0x00200000 | VXC_ADMIN_MAPPER |
Allow access to device mapper |
| 22 | 0x00400000 | VXC_ADMIN_CLOOP |
Allow access to loop devices |
Context flags (cflags)
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.
| Bit | Mask | Name | Description |
|---|---|---|---|
| 0 | 0x00000001 | VXF_INFO_LOCK |
Prohibit further context migration |
| 1 | 0x00000002 | VXF_INFO_SCHED |
Account all processes as one (Legacy) |
| 2 | 0x00000004 | VXF_INFO_NPROC |
Apply process limits to context (Legacy) |
| 3 | 0x00000008 | VXF_INFO_PRIVATE |
Context cannot be entered (Legacy) |
| 4 | 0x00000010 | VXF_INFO_INIT |
Show a fake init process |
| 5 | 0x00000020 | VXF_INFO_HIDE |
Hide context information in task status |
| 6 | 0x00000040 | VXF_INFO_ULIMIT |
Apply ulimits to context (Legacy) |
| 7 | 0x00000080 | VXF_INFO_NSPACE |
Use private namespace (Legacy) |
| 8 | 0x00000100 | VXF_SCHED_HARD |
Enable hard scheduler |
| 9 | 0x00000200 | VXF_SCHED_PRIO |
Enable priority scheduler |
| 10 | 0x00000400 | VXF_SCHED_PAUSE |
Pause context (unschedule) |
| 20 | 0x00010000 | VXF_VIRT_MEM |
Virtualize memory information |
| 21 | 0x00020000 | VXF_VIRT_UPTIME |
Virtualize uptime information |
| 22 | 0x00040000 | VXF_VIRT_CPU |
Virtualize cpu usage information |
| 23 | 0x00080000 | VXF_VIRT_LOAD |
Virtualize load average information |
| 24 | 0x00100000 | VXF_VIRT_TIME |
Allow per guest time offsets |
| 28 | 0x01000000 | VXF_HIDE_MOUNT |
Hide entries in /proc/$pid/mounts |
| 29 | 0x02000000 | VXF_HIDE_NETIF |
Hide foreign network interfaces |
| 30 | 0x04000000 | VXF_HIDE_VINFO |
Hide context information in task status |
| 32 | (1ULL<<32) | VXF_STATE_SETUP |
Enable setup state |
| 33 | (1ULL<<33) | VXF_STATE_INIT |
Enable init state |
| 34 | (1ULL<<34) | VXF_STATE_ADMIN |
Enable admin state |
| 36 | (1ULL<<36) | VXF_SC_HELPER |
Enable state change helper |
| 37 | (1ULL<<37) | VXF_REBOOT_KILL |
Kill all processes on reboot(2) |
| 38 | (1ULL<<38) | VXF_PERSISTENT |
Make context persistent |
| 0 | (1ULL<<48) | VXF_FORK_RSS |
Block fork when RSS limit is exceeded |
| 0 | (1ULL<<49) | VXF_PROLIFIC |
Allow context to create new contexts |
| 0 | (1ULL<<52) | VXF_IGNEG_NICE |
Ignore priority raise |
Network context flags (nflags)
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.
| Bit | Mask | Name | Description |
|---|---|---|---|
| 0 | 0x00000001 | NXF_INFO_LOCK |
Prohibit further context migration |
| 32 | (1ULL<<32) | NXF_STATE_SETUP |
Enable setup state |
| 34 | (1ULL<<34) | NXF_STATE_ADMIN |
Enable admin state |
| 36 | (1ULL<<36) | NXF_SC_HELPER |
Enable state change helper |
| 38 | (1ULL<<38) | NXF_PERSISTENT |
Make network context persistent |