|
Packit |
3a1417 |
.\"
|
|
Packit |
3a1417 |
.\" capsh.1 Man page added 2009-12-23 Andrew G. Morgan <morgan@kernel.org>
|
|
Packit |
3a1417 |
.\"
|
|
Packit |
3a1417 |
.TH CAPSH 1 "2011-04-24" "libcap 2" "User Commands"
|
|
Packit |
3a1417 |
.SH NAME
|
|
Packit |
3a1417 |
capsh \- capability shell wrapper
|
|
Packit |
3a1417 |
.SH SYNOPSIS
|
|
Packit |
3a1417 |
.B capsh
|
|
Packit |
3a1417 |
[\fIOPTION\fR]...
|
|
Packit |
3a1417 |
.SH DESCRIPTION
|
|
Packit |
3a1417 |
Linux capability support and use can be explored and constrained with
|
|
Packit |
3a1417 |
this tool. This tool provides a handy wrapper for certain types
|
|
Packit |
3a1417 |
of capability testing and environment creation. It also provides some
|
|
Packit |
3a1417 |
debugging features useful for summarizing capability state.
|
|
Packit |
3a1417 |
.SH OPTIONS
|
|
Packit |
3a1417 |
The tool takes a number of optional arguments, acting on them in the
|
|
Packit |
3a1417 |
order they are provided. They are as follows:
|
|
Packit |
3a1417 |
.TP 22
|
|
Packit |
3a1417 |
.B --print
|
|
Packit |
3a1417 |
Display prevailing capability and related state.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI -- " [args]"
|
|
Packit |
3a1417 |
Execute
|
|
Packit |
3a1417 |
.B /bin/bash
|
|
Packit |
3a1417 |
with trailing arguments. Note, you can use
|
|
Packit |
3a1417 |
.B -c 'command to execute'
|
|
Packit |
3a1417 |
for specific commands.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.B ==
|
|
Packit |
3a1417 |
Execute
|
|
Packit |
3a1417 |
.B capsh
|
|
Packit |
3a1417 |
again with remaining arguments. Useful for testing
|
|
Packit |
3a1417 |
.BR exec ()
|
|
Packit |
3a1417 |
behavior.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --caps= cap-set
|
|
Packit |
3a1417 |
Set the prevailing process capabilities to those specified by
|
|
Packit |
3a1417 |
.IR cap-set .
|
|
Packit |
3a1417 |
Where
|
|
Packit |
3a1417 |
.I cap-set
|
|
Packit |
3a1417 |
is a text-representation of capability state as per
|
|
Packit |
3a1417 |
.BR cap_from_text (3).
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --drop= cap-list
|
|
Packit |
3a1417 |
Remove the listed capabilities from the prevailing bounding set. The
|
|
Packit |
3a1417 |
capabilites are a comma separated list of capabilities as recognized
|
|
Packit |
3a1417 |
by the
|
|
Packit |
3a1417 |
.BR cap_from_name (3)
|
|
Packit |
3a1417 |
function. Use of this feature requires that the capsh program is
|
|
Packit |
3a1417 |
operating with
|
|
Packit |
3a1417 |
.B CAP_SETPCAP
|
|
Packit |
3a1417 |
in its effective set.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --inh= cap-list
|
|
Packit |
3a1417 |
Set the inheritable set of capabilities for the current process to
|
|
Packit |
3a1417 |
equal those provided in the comma separated list. For this action to
|
|
Packit |
3a1417 |
succeed, the prevailing process should already have each of these
|
|
Packit |
3a1417 |
capabilities in the union of the current inheritable and permitted
|
|
Packit |
3a1417 |
capability sets, or the capsh program is operating with
|
|
Packit |
3a1417 |
.B CAP_SETPCAP
|
|
Packit |
3a1417 |
in its effective set.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --user= username
|
|
Packit |
3a1417 |
Assume the identity of the named user. That is, look up the user's
|
|
Packit |
3a1417 |
.IR uid " and " gid
|
|
Packit |
3a1417 |
with
|
|
Packit |
3a1417 |
.BR getpwuid (3)
|
|
Packit |
3a1417 |
and their group memberships with
|
|
Packit |
3a1417 |
.BR getgrouplist (3)
|
|
Packit |
3a1417 |
and set them all.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --uid= id
|
|
Packit |
3a1417 |
Force all
|
|
Packit |
3a1417 |
.B uid
|
|
Packit |
3a1417 |
values to equal
|
|
Packit |
3a1417 |
.I id
|
|
Packit |
3a1417 |
using the
|
|
Packit |
3a1417 |
.BR setuid (2)
|
|
Packit |
3a1417 |
system call.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --gid= <id>
|
|
Packit |
3a1417 |
Force all
|
|
Packit |
3a1417 |
.B gid
|
|
Packit |
3a1417 |
values to equal
|
|
Packit |
3a1417 |
.I id
|
|
Packit |
3a1417 |
using the
|
|
Packit |
3a1417 |
.BR setgid (2)
|
|
Packit |
3a1417 |
system call.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --groups= <id-list>
|
|
Packit |
3a1417 |
Set the supplementary groups to the numerical list provided. The
|
|
Packit |
3a1417 |
groups are set with the
|
|
Packit |
3a1417 |
.BR setgroups (2)
|
|
Packit |
3a1417 |
system call.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --keep= <0|1>
|
|
Packit |
3a1417 |
In a non-pure capability mode, the kernel provides liberal privilege
|
|
Packit |
3a1417 |
to the super-user. However, it is normally the case that when the
|
|
Packit |
3a1417 |
super-user changes
|
|
Packit |
3a1417 |
.I uid
|
|
Packit |
3a1417 |
to some lesser user, then capabilities are dropped. For these
|
|
Packit |
3a1417 |
situations, the kernel can permit the process to retain its
|
|
Packit |
3a1417 |
capabilities after a
|
|
Packit |
3a1417 |
.BR setuid (2)
|
|
Packit |
3a1417 |
system call. This feature is known as
|
|
Packit |
3a1417 |
.I keep-caps
|
|
Packit |
3a1417 |
support. The way to activate it using this script is with this
|
|
Packit |
3a1417 |
argument. Setting the value to 1 will cause
|
|
Packit |
3a1417 |
.I keep-caps
|
|
Packit |
3a1417 |
to be active. Setting it to 0 will cause keep-caps to deactivate for
|
|
Packit |
3a1417 |
the current process. In all cases,
|
|
Packit |
3a1417 |
.I keep-caps
|
|
Packit |
3a1417 |
is deactivated when an
|
|
Packit |
3a1417 |
.BR exec ()
|
|
Packit |
3a1417 |
is performed. See
|
|
Packit |
3a1417 |
.B --secbits
|
|
Packit |
3a1417 |
for ways to disable this feature.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --secbits= N
|
|
Packit |
3a1417 |
XXX - need to document this feature.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --chroot= path
|
|
Packit |
3a1417 |
Execute the
|
|
Packit |
3a1417 |
.BR chroot (2)
|
|
Packit |
3a1417 |
system call with the new root-directory (/) equal to
|
|
Packit |
3a1417 |
.IR path .
|
|
Packit |
3a1417 |
This operation requires
|
|
Packit |
3a1417 |
.B CAP_SYS_CHROOT
|
|
Packit |
3a1417 |
to be in effect.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --forkfor= sec
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --killit= sig
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --decode= N
|
|
Packit |
3a1417 |
This is a convenience feature. If you look at
|
|
Packit |
3a1417 |
.B /proc/1/status
|
|
Packit |
3a1417 |
there are some capability related fields of the following form:
|
|
Packit |
3a1417 |
|
|
Packit |
3a1417 |
CapInh: 0000000000000000
|
|
Packit |
3a1417 |
CapPrm: ffffffffffffffff
|
|
Packit |
3a1417 |
CapEff: fffffffffffffeff
|
|
Packit |
3a1417 |
CapBnd: ffffffffffffffff
|
|
Packit |
3a1417 |
|
|
Packit |
3a1417 |
This option provides a quick way to decode a capability vector
|
|
Packit |
3a1417 |
represented in this form. For example, the missing capability from
|
|
Packit |
3a1417 |
this effective set is 0x0100. By running:
|
|
Packit |
3a1417 |
|
|
Packit |
3a1417 |
capsh --decode=0x0100
|
|
Packit |
3a1417 |
|
|
Packit |
3a1417 |
we observe that the missing capability is:
|
|
Packit |
3a1417 |
.BR cap_setpcap .
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.BI --supports= xxx
|
|
Packit |
3a1417 |
As the kernel evolves, more capabilities are added. This option can be used
|
|
Packit |
3a1417 |
to verify the existence of a capability on the system. For example,
|
|
Packit |
3a1417 |
.BI --supports= cap_syslog
|
|
Packit |
3a1417 |
will cause capsh to promptly exit with a status of 1 when run on
|
|
Packit |
3a1417 |
kernel 2.6.27. However, when run on kernel 2.6.38 it will silently
|
|
Packit |
3a1417 |
succeed.
|
|
Packit |
3a1417 |
.TP
|
|
Packit |
3a1417 |
.SH "EXIT STATUS"
|
|
Packit |
3a1417 |
Following successful execution the tool exits with status 0. Following
|
|
Packit |
3a1417 |
an error, the tool immediately exits with status 1.
|
|
Packit |
3a1417 |
.SH AUTHOR
|
|
Packit |
3a1417 |
Written by Andrew G. Morgan <morgan@kernel.org>.
|
|
Packit |
3a1417 |
.SH "REPORTING BUGS"
|
|
Packit |
3a1417 |
Please report bugs to the author.
|
|
Packit |
3a1417 |
.SH "SEE ALSO"
|
|
Packit |
3a1417 |
.BR libcap (3),
|
|
Packit |
3a1417 |
.BR getcap (8), setcap (8)
|
|
Packit |
3a1417 |
and
|
|
Packit |
3a1417 |
.BR capabilities (7).
|