|
Packit |
7cfc04 |
.\" written by Andrew Morgan <morgan@kernel.org>
|
|
Packit |
7cfc04 |
.\"
|
|
Packit |
7cfc04 |
.\" %%%LICENSE_START(GPL_NOVERSION_ONELINE)
|
|
Packit |
7cfc04 |
.\" may be distributed as per GPL
|
|
Packit |
7cfc04 |
.\" %%%LICENSE_END
|
|
Packit |
7cfc04 |
.\"
|
|
Packit |
7cfc04 |
.\" Modified by David A. Wheeler <dwheeler@ida.org>
|
|
Packit |
7cfc04 |
.\" Modified 2004-05-27, mtk
|
|
Packit |
7cfc04 |
.\" Modified 2004-06-21, aeb
|
|
Packit |
7cfc04 |
.\" Modified 2008-04-28, morgan of kernel.org
|
|
Packit |
7cfc04 |
.\" Update in line with addition of file capabilities and
|
|
Packit |
7cfc04 |
.\" 64-bit capability sets in kernel 2.6.2[45].
|
|
Packit |
7cfc04 |
.\" Modified 2009-01-26, andi kleen
|
|
Packit |
7cfc04 |
.\"
|
|
Packit |
7cfc04 |
.TH CAPGET 2 2017-09-15 "Linux" "Linux Programmer's Manual"
|
|
Packit |
7cfc04 |
.SH NAME
|
|
Packit |
7cfc04 |
capget, capset \- set/get capabilities of thread(s)
|
|
Packit |
7cfc04 |
.SH SYNOPSIS
|
|
Packit |
7cfc04 |
.B #include <sys/capability.h>
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
.BI "int capget(cap_user_header_t " hdrp ", cap_user_data_t " datap );
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
.BI "int capset(cap_user_header_t " hdrp ", const cap_user_data_t " datap );
|
|
Packit |
7cfc04 |
.SH DESCRIPTION
|
|
Packit |
7cfc04 |
Since Linux 2.2,
|
|
Packit |
7cfc04 |
the power of the superuser (root) has been partitioned into
|
|
Packit |
7cfc04 |
a set of discrete capabilities.
|
|
Packit |
7cfc04 |
Each thread has a set of effective capabilities identifying
|
|
Packit |
7cfc04 |
which capabilities (if any) it may currently exercise.
|
|
Packit |
7cfc04 |
Each thread also has a set of inheritable capabilities that may be
|
|
Packit |
7cfc04 |
passed through an
|
|
Packit |
7cfc04 |
.BR execve (2)
|
|
Packit |
7cfc04 |
call, and a set of permitted capabilities
|
|
Packit |
7cfc04 |
that it can make effective or inheritable.
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
These two system calls are the raw kernel interface for getting and
|
|
Packit |
7cfc04 |
setting thread capabilities.
|
|
Packit |
7cfc04 |
Not only are these system calls specific to Linux,
|
|
Packit |
7cfc04 |
but the kernel API is likely to change and use of
|
|
Packit |
7cfc04 |
these system calls (in particular the format of the
|
|
Packit |
7cfc04 |
.I cap_user_*_t
|
|
Packit |
7cfc04 |
types) is subject to extension with each kernel revision,
|
|
Packit |
7cfc04 |
but old programs will keep working.
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
The portable interfaces are
|
|
Packit |
7cfc04 |
.BR cap_set_proc (3)
|
|
Packit |
7cfc04 |
and
|
|
Packit |
7cfc04 |
.BR cap_get_proc (3);
|
|
Packit |
7cfc04 |
if possible, you should use those interfaces in applications.
|
|
Packit |
7cfc04 |
If you wish to use the Linux extensions in applications, you should
|
|
Packit |
7cfc04 |
use the easier-to-use interfaces
|
|
Packit |
7cfc04 |
.BR capsetp (3)
|
|
Packit |
7cfc04 |
and
|
|
Packit |
7cfc04 |
.BR capgetp (3).
|
|
Packit |
7cfc04 |
.SS Current details
|
|
Packit |
7cfc04 |
Now that you have been warned, some current kernel details.
|
|
Packit |
7cfc04 |
The structures are defined as follows.
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
.in +4n
|
|
Packit |
7cfc04 |
.EX
|
|
Packit |
7cfc04 |
#define _LINUX_CAPABILITY_VERSION_1 0x19980330
|
|
Packit |
7cfc04 |
#define _LINUX_CAPABILITY_U32S_1 1
|
|
Packit |
7cfc04 |
|
|
Packit |
7cfc04 |
/* V2 added in Linux 2.6.25; deprecated */
|
|
Packit |
7cfc04 |
#define _LINUX_CAPABILITY_VERSION_2 0x20071026
|
|
Packit |
7cfc04 |
.\" commit e338d263a76af78fe8f38a72131188b58fceb591
|
|
Packit |
7cfc04 |
.\" Added 64 bit capability support
|
|
Packit |
7cfc04 |
#define _LINUX_CAPABILITY_U32S_2 2
|
|
Packit |
7cfc04 |
|
|
Packit |
7cfc04 |
/* V3 added in Linux 2.6.26 */
|
|
Packit |
7cfc04 |
#define _LINUX_CAPABILITY_VERSION_3 0x20080522
|
|
Packit |
7cfc04 |
.\" commit ca05a99a54db1db5bca72eccb5866d2a86f8517f
|
|
Packit |
7cfc04 |
#define _LINUX_CAPABILITY_U32S_3 2
|
|
Packit |
7cfc04 |
|
|
Packit |
7cfc04 |
typedef struct __user_cap_header_struct {
|
|
Packit |
7cfc04 |
__u32 version;
|
|
Packit |
7cfc04 |
int pid;
|
|
Packit |
7cfc04 |
} *cap_user_header_t;
|
|
Packit |
7cfc04 |
|
|
Packit |
7cfc04 |
typedef struct __user_cap_data_struct {
|
|
Packit |
7cfc04 |
__u32 effective;
|
|
Packit |
7cfc04 |
__u32 permitted;
|
|
Packit |
7cfc04 |
__u32 inheritable;
|
|
Packit |
7cfc04 |
} *cap_user_data_t;
|
|
Packit |
7cfc04 |
.EE
|
|
Packit |
7cfc04 |
.in
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
The
|
|
Packit |
7cfc04 |
.IR effective ,
|
|
Packit |
7cfc04 |
.IR permitted ,
|
|
Packit |
7cfc04 |
and
|
|
Packit |
7cfc04 |
.I inheritable
|
|
Packit |
7cfc04 |
fields are bit masks of the capabilities defined in
|
|
Packit |
7cfc04 |
.BR capabilities (7).
|
|
Packit |
7cfc04 |
Note that the
|
|
Packit |
7cfc04 |
.B CAP_*
|
|
Packit |
7cfc04 |
values are bit indexes and need to be bit-shifted before ORing into
|
|
Packit |
7cfc04 |
the bit fields.
|
|
Packit |
7cfc04 |
To define the structures for passing to the system call, you have to use the
|
|
Packit |
7cfc04 |
.I struct __user_cap_header_struct
|
|
Packit |
7cfc04 |
and
|
|
Packit |
7cfc04 |
.I struct __user_cap_data_struct
|
|
Packit |
7cfc04 |
names because the typedefs are only pointers.
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
Kernels prior to 2.6.25 prefer
|
|
Packit |
7cfc04 |
32-bit capabilities with version
|
|
Packit |
7cfc04 |
.BR _LINUX_CAPABILITY_VERSION_1 .
|
|
Packit |
7cfc04 |
Linux 2.6.25 added 64-bit capability sets, with version
|
|
Packit |
7cfc04 |
.BR _LINUX_CAPABILITY_VERSION_2 .
|
|
Packit |
7cfc04 |
There was, however, an API glitch, and Linux 2.6.26 added
|
|
Packit |
7cfc04 |
.BR _LINUX_CAPABILITY_VERSION_3
|
|
Packit |
7cfc04 |
to fix the problem.
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
Note that 64-bit capabilities use
|
|
Packit |
7cfc04 |
.IR datap [0]
|
|
Packit |
7cfc04 |
and
|
|
Packit |
7cfc04 |
.IR datap [1],
|
|
Packit |
7cfc04 |
whereas 32-bit capabilities use only
|
|
Packit |
7cfc04 |
.IR datap [0].
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
On kernels that support file capabilities (VFS capabilities support),
|
|
Packit |
7cfc04 |
these system calls behave slightly differently.
|
|
Packit |
7cfc04 |
This support was added as an option in Linux 2.6.24,
|
|
Packit |
7cfc04 |
and became fixed (nonoptional) in Linux 2.6.33.
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
For
|
|
Packit |
7cfc04 |
.BR capget ()
|
|
Packit |
7cfc04 |
calls, one can probe the capabilities of any process by specifying its
|
|
Packit |
7cfc04 |
process ID with the
|
|
Packit |
7cfc04 |
.I hdrp->pid
|
|
Packit |
7cfc04 |
field value.
|
|
Packit |
7cfc04 |
.SS With VFS capabilities support
|
|
Packit |
7cfc04 |
VFS capabilities employ a file extended attribute (see
|
|
Packit |
7cfc04 |
.BR xattr (7))
|
|
Packit |
7cfc04 |
to allow capabilities to be attached to executables.
|
|
Packit |
7cfc04 |
This privilege model obsoletes kernel support for one process
|
|
Packit |
7cfc04 |
asynchronously setting the capabilities of another.
|
|
Packit |
7cfc04 |
That is, on kernels that have VFS capabilities support, when calling
|
|
Packit |
7cfc04 |
.BR capset (),
|
|
Packit |
7cfc04 |
the only permitted values for
|
|
Packit |
7cfc04 |
.I hdrp->pid
|
|
Packit |
7cfc04 |
are 0 or, equivalently, the value returned by
|
|
Packit |
7cfc04 |
.BR gettid (2).
|
|
Packit |
7cfc04 |
.\"
|
|
Packit |
7cfc04 |
.SS Without VFS capabilities support
|
|
Packit |
7cfc04 |
On older kernels that do not provide VFS capabilities support
|
|
Packit |
7cfc04 |
.BR capset ()
|
|
Packit |
7cfc04 |
can, if the caller has the
|
|
Packit |
7cfc04 |
.BR CAP_SETPCAP
|
|
Packit |
7cfc04 |
capability, be used to change not only the caller's own capabilities,
|
|
Packit |
7cfc04 |
but also the capabilities of other threads.
|
|
Packit |
7cfc04 |
The call operates on the capabilities of the thread specified by the
|
|
Packit |
7cfc04 |
.I pid
|
|
Packit |
7cfc04 |
field of
|
|
Packit |
7cfc04 |
.I hdrp
|
|
Packit |
7cfc04 |
when that is nonzero, or on the capabilities of the calling thread if
|
|
Packit |
7cfc04 |
.I pid
|
|
Packit |
7cfc04 |
is 0.
|
|
Packit |
7cfc04 |
If
|
|
Packit |
7cfc04 |
.I pid
|
|
Packit |
7cfc04 |
refers to a single-threaded process, then
|
|
Packit |
7cfc04 |
.I pid
|
|
Packit |
7cfc04 |
can be specified as a traditional process ID;
|
|
Packit |
7cfc04 |
operating on a thread of a multithreaded process requires a thread ID
|
|
Packit |
7cfc04 |
of the type returned by
|
|
Packit |
7cfc04 |
.BR gettid (2).
|
|
Packit |
7cfc04 |
For
|
|
Packit |
7cfc04 |
.BR capset (),
|
|
Packit |
7cfc04 |
.I pid
|
|
Packit |
7cfc04 |
can also be: \-1, meaning perform the change on all threads except the
|
|
Packit |
7cfc04 |
caller and
|
|
Packit |
7cfc04 |
.BR init (1);
|
|
Packit |
7cfc04 |
or a value less than \-1, in which case the change is applied
|
|
Packit |
7cfc04 |
to all members of the process group whose ID is \-\fIpid\fP.
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
For details on the data, see
|
|
Packit |
7cfc04 |
.BR capabilities (7).
|
|
Packit |
7cfc04 |
.SH RETURN VALUE
|
|
Packit |
7cfc04 |
On success, zero is returned.
|
|
Packit |
7cfc04 |
On error, \-1 is returned, and
|
|
Packit |
7cfc04 |
.I errno
|
|
Packit |
7cfc04 |
is set appropriately.
|
|
Packit |
7cfc04 |
.PP
|
|
Packit |
7cfc04 |
The calls fail with the error
|
|
Packit |
7cfc04 |
.BR EINVAL ,
|
|
Packit |
7cfc04 |
and set the
|
|
Packit |
7cfc04 |
.I version
|
|
Packit |
7cfc04 |
field of
|
|
Packit |
7cfc04 |
.I hdrp
|
|
Packit |
7cfc04 |
to the kernel preferred value of
|
|
Packit |
7cfc04 |
.B _LINUX_CAPABILITY_VERSION_?
|
|
Packit |
7cfc04 |
when an unsupported
|
|
Packit |
7cfc04 |
.I version
|
|
Packit |
7cfc04 |
value is specified.
|
|
Packit |
7cfc04 |
In this way, one can probe what the current
|
|
Packit |
7cfc04 |
preferred capability revision is.
|
|
Packit |
7cfc04 |
.SH ERRORS
|
|
Packit |
7cfc04 |
.TP
|
|
Packit |
7cfc04 |
.B EFAULT
|
|
Packit |
7cfc04 |
Bad memory address.
|
|
Packit |
7cfc04 |
.I hdrp
|
|
Packit |
7cfc04 |
must not be NULL.
|
|
Packit |
7cfc04 |
.I datap
|
|
Packit |
7cfc04 |
may be NULL only when the user is trying to determine the preferred
|
|
Packit |
7cfc04 |
capability version format supported by the kernel.
|
|
Packit |
7cfc04 |
.TP
|
|
Packit |
7cfc04 |
.B EINVAL
|
|
Packit |
7cfc04 |
One of the arguments was invalid.
|
|
Packit |
7cfc04 |
.TP
|
|
Packit |
7cfc04 |
.B EPERM
|
|
Packit |
7cfc04 |
An attempt was made to add a capability to the Permitted set, or to set
|
|
Packit |
7cfc04 |
a capability in the Effective or Inheritable sets that is not in the
|
|
Packit |
7cfc04 |
Permitted set.
|
|
Packit |
7cfc04 |
.TP
|
|
Packit |
7cfc04 |
.B EPERM
|
|
Packit |
7cfc04 |
The caller attempted to use
|
|
Packit |
7cfc04 |
.BR capset ()
|
|
Packit |
7cfc04 |
to modify the capabilities of a thread other than itself,
|
|
Packit |
7cfc04 |
but lacked sufficient privilege.
|
|
Packit |
7cfc04 |
For kernels supporting VFS
|
|
Packit |
7cfc04 |
capabilities, this is never permitted.
|
|
Packit |
7cfc04 |
For kernels lacking VFS
|
|
Packit |
7cfc04 |
support, the
|
|
Packit |
7cfc04 |
.B CAP_SETPCAP
|
|
Packit |
7cfc04 |
capability is required.
|
|
Packit |
7cfc04 |
(A bug in kernels before 2.6.11 meant that this error could also
|
|
Packit |
7cfc04 |
occur if a thread without this capability tried to change its
|
|
Packit |
7cfc04 |
own capabilities by specifying the
|
|
Packit |
7cfc04 |
.I pid
|
|
Packit |
7cfc04 |
field as a nonzero value (i.e., the value returned by
|
|
Packit |
7cfc04 |
.BR getpid (2))
|
|
Packit |
7cfc04 |
instead of 0.)
|
|
Packit |
7cfc04 |
.TP
|
|
Packit |
7cfc04 |
.B ESRCH
|
|
Packit |
7cfc04 |
No such thread.
|
|
Packit |
7cfc04 |
.SH CONFORMING TO
|
|
Packit |
7cfc04 |
These system calls are Linux-specific.
|
|
Packit |
7cfc04 |
.SH NOTES
|
|
Packit |
7cfc04 |
The portable interface to the capability querying and setting
|
|
Packit |
7cfc04 |
functions is provided by the
|
|
Packit |
7cfc04 |
.I libcap
|
|
Packit |
7cfc04 |
library and is available here:
|
|
Packit |
7cfc04 |
.br
|
|
Packit |
7cfc04 |
.UR http://git.kernel.org/cgit\:/linux\:/kernel\:/git\:/morgan\:\:/libcap.git
|
|
Packit |
7cfc04 |
.UE
|
|
Packit |
7cfc04 |
.SH SEE ALSO
|
|
Packit |
7cfc04 |
.BR clone (2),
|
|
Packit |
7cfc04 |
.BR gettid (2),
|
|
Packit |
7cfc04 |
.BR capabilities (7)
|
|
Packit |
7cfc04 |
.SH COLOPHON
|
|
Packit |
7cfc04 |
This page is part of release 4.15 of the Linux
|
|
Packit |
7cfc04 |
.I man-pages
|
|
Packit |
7cfc04 |
project.
|
|
Packit |
7cfc04 |
A description of the project,
|
|
Packit |
7cfc04 |
information about reporting bugs,
|
|
Packit |
7cfc04 |
and the latest version of this page,
|
|
Packit |
7cfc04 |
can be found at
|
|
Packit |
7cfc04 |
\%https://www.kernel.org/doc/man\-pages/.
|