bend-osdev-caps
Search uses release 0.1.0.0 · 282 definitions
Definitions (282)
- type CapSetWA set is two words: capabilities 0 to 31 are the bits of a native U32 (bit k is capability k), and capabilities 32 to 40 a Word(9n) (bit j is capability 32 + j).
- def CapSet
- def CapSet.empty
- def CapSet.full
- def CapSet.union
- def CapSet.inter
- def CapSet.minusthe capabilities of a not in b
- def CapSet.subseta within b: no bit of a outside b (on the low word, a & ~b == 0)
- def CapSet.is_eq
- def CapSetW.single.go
- def CapSetW.singlethe set holding capability k alone (k is 0 to 40)
- def CapSet.of.go
- def CapSet.ofthe set holding capability k alone (empty if k is not a capability)
- def CapSet.has.go
- def CapSet.haswhether capability k is in s
- def CapSet.add
- def CapSet.del
- def CapSet.from_list
- def CapSetW.push
- def CapSetW.lo_listthe capabilities among the low n bits of w, numbered from k, then rest
- def CapSet.to_list
- def CapSetW.bit
- def CapSetW.word_u32the value of the n bits of w, and the n low bits of a, as native words
- def CapSetW.u32_word
- def CapSet.to_w64the 64-bit mask of a set, as capget(2) and /proc/<pid>/status show it
- def CapSet.from_w64the set of the low 41 bits of a 64-bit mask
- def CapSet.show16 hex digits, as the CapEff line of /proc/<pid>/status
- type CapState
- def CapState.permitted
- def CapState.inheritable
- def CapState.effective
- def CapState.bounding
- def CapState.ambient
- def CapState.with_bounding
- def CapState.with_ambient
- def CapState.validcapabilities(7)'s invariants: effective within permitted, and no capability ambient unless it is both permitted and inheritable
- type CapCredA thread's credentials: real, effective and saved set-user-ID, the securebits SECBIT_NOROOT and SECBIT_NO_CAP_AMBIENT_RAISE, and the sets.
- def CapCred.ruid
- def CapCred.euid
- def CapCred.suid
- def CapCred.no_ambient_raise
- def CapCred.sets
- def CapCred.with_sets
- type CapFileSetsA file's capabilities (the security.capability attribute)
- type CapFileAn executable: its owner, its set-user-ID and set-group-ID bits, and its capabilities, if it has any
- type CapsKernelThe kernel's choices: the highest capability it supports (/proc/sys/kernel/cap_last_cap; at most 40 here) and whether file capabilities are on (off when booted with no_file_caps)
- def CapsKernel.linuxLinux since 5.9: capabilities 0 to 40, file capabilities on
- def CapsKernel.file_caps
- def CapsKernel.validwhether c names a capability this kernel supports
- type CapsErrorWhy a call fails
- def CapsError.errnothe errno the kernel answers: EINVAL (22) for a capability it does not support, EPERM (1) otherwise
- def Caps.orthe credentials after a call: the new ones, or c if it failed
- def Caps.sets_orthe sets after a call, or s if it failed
- type CapExecFlagsThe file's sets as the transformation uses them (the notional all-ones sets of the root rules, or the file's own), the notional effective bit, and whether the file is privileged (set-user-ID, set-group-ID, or with capabilities).
- def CapExec.ambient
- def CapExec.effective
- def CapExec.setscapabilities(7): P'(ambient) = (file is privileged) ?
- def CapExec.euidthe effective user ID after execve: the file's owner if it is set-user-ID, unless set-ID bits are ignored
- def CapExec.fcapsthe file's capabilities, unless they are ignored
- def CapExec.has_caps
- def CapExec.privilegeda privileged file: set-user-ID, set-group-ID, or with capabilities
- def CapExec.flags.filethe file's own sets (empty when it has none); effective is the notional effective bit of the root rules, ORed with the file's own
- def CapExec.flags.suid_rooteffective UID 0 but real UID not: the file's sets are all ones, unless the file has capabilities (a set-user-ID-root program with file capabilities)
- def CapExec.fc_effective
- def CapExec.flags.go"Capabilities and execution of programs by root": with r0 (real UID 0) and e0 (effective UID 0, after the set-user-ID bit), unless SECBIT_NOROOT: (1) the file's inheritable and permitted sets are all ones (but a set-user-ID-root program with capabilities run by a non-root real UID keeps its own); (2) if e0, the file effective bit is one.
- def CapExec.file_capsthe file's capabilities as execve sees them: none if ign, or if the kernel has file capabilities off
- def CapExec.flags.mk
- def CapExec.flags
- def Caps.execve.setsThe thread's sets after it executes f.
- def CapExec.dumb_ok"Safety checking for capability-dumb binaries": a file with capabilities and the effective bit must grant all of its permitted set
- def CapExec.fin
- def CapExec.new_euid
- def Caps.execveexecve(2) of f: the new credentials (the effective user ID changes for a set-user-ID file, and the saved set-user-ID becomes the effective one), or CapsCapabilityDumb (EPERM)