| #ifdef CAPSHDOC |
| #error "don't include this twice" |
| #endif |
| #define CAPSHDOC |
| |
| /* |
| * A line by line explanation of each named capability value |
| */ |
| static const char *explanation0[] = { /* cap_chown = 0 */ |
| "Allows a process to arbitrarily change the user and", |
| "group ownership of a file.", |
| NULL |
| }; |
| static const char *explanation1[] = { /* cap_dac_override = 1 */ |
| "Allows a process to override of all Discretionary", |
| "Access Control (DAC) access, including ACL execute", |
| "access. That is read, write or execute files that the", |
| "process would otherwise not have access to. This", |
| "excludes DAC access covered by CAP_LINUX_IMMUTABLE.", |
| NULL |
| }; |
| static const char *explanation2[] = { /* cap_dac_read_search = 2 */ |
| "Allows a process to override all DAC restrictions", |
| "limiting the read and search of files and", |
| "directories. This excludes DAC access covered by", |
| "CAP_LINUX_IMMUTABLE.", |
| NULL |
| }; |
| static const char *explanation3[] = { /* cap_fowner = 3 */ |
| "Allows a process to perform operations on files, even", |
| "where file owner ID should otherwise need be equal to", |
| "the UID, except where CAP_FSETID is applicable. It", |
| "doesn't override MAC and DAC restrictions.", |
| NULL |
| }; |
| static const char *explanation4[] = { /* cap_fsetid = 4 */ |
| "Allows a process to set the S_ISUID and S_ISUID bits of", |
| "the file permissions, even when the process' effective", |
| "UID or GID/supplementary GIDs do not match that of the", |
| "file.", |
| NULL |
| }; |
| static const char *explanation5[] = { /* cap_kill = 5 */ |
| "Allows a process to send a kill(2) signal to any other", |
| "process - overriding the limitation that there be a", |
| "[E]UID match between source and target process.", |
| NULL |
| }; |
| static const char *explanation6[] = { /* cap_setgid = 6 */ |
| "Allows a process to freely manipulate its own GIDs:", |
| " - arbitrarily set the GID, EGID, REGID, RESGID values", |
| " - arbitrarily set the supplementary GIDs", |
| " - allows the forging of GID credentials passed over a", |
| " socket", |
| NULL |
| }; |
| static const char *explanation7[] = { /* cap_setuid = 7 */ |
| "Allows a process to freely manipulate its own UIDs:", |
| " - arbitrarily set the UID, EUID, REUID and RESUID", |
| " values", |
| " - allows the forging of UID credentials passed over a", |
| " socket", |
| NULL |
| }; |
| static const char *explanation8[] = { /* cap_setpcap = 8 */ |
| "Allows a process to freely manipulate its inheritable", |
| "capabilities. Linux supports the POSIX.1e Inheritable", |
| "set, as well as Bounding and Ambient Linux extension", |
| "vectors. This capability permits dropping bits from the", |
| "Bounding vector. It also permits the process to raise", |
| "Ambient vector bits that are both raised in the", |
| "Permitted and Inheritable sets of the process. This", |
| "capability cannot be used to raise Permitted bits, or", |
| "Effective bits beyond those already present in the", |
| "process' permitted set.", |
| "", |
| "[Historical note: prior to the advent of file", |
| "capabilities (2008), this capability was suppressed by", |
| "default, as its unsuppressed behavior was not", |
| "auditable: it could asynchronously grant its own", |
| "Permitted capabilities to and remove capabilities from", |
| "other processes arbitrarily. The former leads to", |
| "undefined behavior, and the latter is better served by", |
| "the kill system call.]", |
| NULL |
| }; |
| static const char *explanation9[] = { /* cap_linux_immutable = 9 */ |
| "Allows a process to modify the S_IMMUTABLE and", |
| "S_APPEND file attributes.", |
| NULL |
| }; |
| static const char *explanation10[] = { /* cap_net_bind_service = 10 */ |
| "Allows a process to bind to privileged ports:", |
| " - TCP/UDP sockets below 1024", |
| " - ATM VCIs below 32", |
| NULL |
| }; |
| static const char *explanation11[] = { /* cap_net_broadcast = 11 */ |
| "Allows a process to broadcast to the network and to", |
| "listen to multicast.", |
| NULL |
| }; |
| static const char *explanation12[] = { /* cap_net_admin = 12 */ |
| "Allows a process to perform network configuration", |
| "operations:", |
| " - interface configuration", |
| " - administration of IP firewall, masquerading and", |
| " accounting", |
| " - setting debug options on sockets", |
| " - modification of routing tables", |
| " - setting arbitrary process, and process group", |
| " ownership on sockets", |
| " - binding to any address for transparent proxying", |
| " (this is also allowed via CAP_NET_RAW)", |
| " - setting TOS (Type of service)", |
| " - setting promiscuous mode", |
| " - clearing driver statistics", |
| " - multicasing", |
| " - read/write of device-specific registers", |
| " - activation of ATM control sockets", |
| NULL |
| }; |
| static const char *explanation13[] = { /* cap_net_raw = 13 */ |
| "Allows a process to use raw networking:", |
| " - RAW sockets", |
| " - PACKET sockets", |
| " - binding to any address for transparent proxying", |
| " (also permitted via CAP_NET_ADMIN)", |
| NULL |
| }; |
| static const char *explanation14[] = { /* cap_ipc_lock = 14 */ |
| "Allows a process to lock shared memory segments for IPC", |
| "purposes. Also enables mlock and mlockall system", |
| "calls.", |
| NULL |
| }; |
| static const char *explanation15[] = { /* cap_ipc_owner = 15 */ |
| "Allows a process to override IPC ownership checks.", |
| NULL |
| }; |
| static const char *explanation16[] = { /* cap_sys_module = 16 */ |
| "Allows a process to initiate the loading and unloading", |
| "of kernel modules. This capability can effectively", |
| "modify kernel without limit.", |
| NULL |
| }; |
| static const char *explanation17[] = { /* cap_sys_rawio = 17 */ |
| "Allows a process to perform raw IO:", |
| " - permit ioper/iopl access", |
| " - permit sending USB messages to any device via", |
| " /dev/bus/usb", |
| NULL |
| }; |
| static const char *explanation18[] = { /* cap_sys_chroot = 18 */ |
| "Allows a process to perform a chroot syscall to change", |
| "the effective root of the process' file system:", |
| "redirect to directory \"/\" to some other location.", |
| NULL |
| }; |
| static const char *explanation19[] = { /* cap_sys_ptrace = 19 */ |
| "Allows a process to perform a ptrace() of any other", |
| "process.", |
| NULL |
| }; |
| static const char *explanation20[] = { /* cap_sys_pacct = 20 */ |
| "Allows a process to configure process accounting.", |
| NULL |
| }; |
| static const char *explanation21[] = { /* cap_sys_admin = 21 */ |
| "Allows a process to perform a somewhat arbitrary", |
| "grab-bag of privileged operations. Over time, this", |
| "capability should weaken as specific capabilities are", |
| "created for subsets of CAP_SYS_ADMINs functionality:", |
| " - configuration of the secure attention key", |
| " - administration of the random device", |
| " - examination and configuration of disk quotas", |
| " - setting the domainname", |
| " - setting the hostname", |
| " - calling bdflush()", |
| " - mount() and umount(), setting up new SMB connection", |
| " - some autofs root ioctls", |
| " - nfsservctl", |
| " - VM86_REQUEST_IRQ", |
| " - to read/write pci config on alpha", |
| " - irix_prctl on mips (setstacksize)", |
| " - flushing all cache on m68k (sys_cacheflush)", |
| " - removing semaphores", |
| " - Used instead of CAP_CHOWN to \"chown\" IPC message", |
| " queues, semaphores and shared memory", |
| " - locking/unlocking of shared memory segment", |
| " - turning swap on/off", |
| " - forged pids on socket credentials passing", |
| " - setting readahead and flushing buffers on block", |
| " devices", |
| " - setting geometry in floppy driver", |
| " - turning DMA on/off in xd driver", |
| " - administration of md devices (mostly the above, but", |
| " some extra ioctls)", |
| " - tuning the ide driver", |
| " - access to the nvram device", |
| " - administration of apm_bios, serial and bttv (TV)", |
| " device", |
| " - manufacturer commands in isdn CAPI support driver", |
| " - reading non-standardized portions of PCI", |
| " configuration space", |
| " - DDI debug ioctl on sbpcd driver", |
| " - setting up serial ports", |
| " - sending raw qic-117 commands", |
| " - enabling/disabling tagged queuing on SCSI", |
| " controllers and sending arbitrary SCSI commands", |
| " - setting encryption key on loopback filesystem", |
| " - setting zone reclaim policy", |
| NULL |
| }; |
| static const char *explanation22[] = { /* cap_sys_boot = 22 */ |
| "Allows a process to initiate a reboot of the system.", |
| NULL |
| }; |
| static const char *explanation23[] = { /* cap_sys_nice = 23 */ |
| "Allows a process to maipulate the execution priorities", |
| "of arbitrary processes:", |
| " - those involving different UIDs", |
| " - setting their CPU affinity", |
| " - alter the FIFO vs. round-robin (realtime)", |
| " scheduling for itself and other processes.", |
| NULL |
| }; |
| static const char *explanation24[] = { /* cap_sys_resource = 24 */ |
| "Allows a process to adjust resource related parameters", |
| "of processes and the system:", |
| " - set and override resource limits", |
| " - override quota limits", |
| " - override the reserved space on ext2 filesystem", |
| " (this can also be achieved via CAP_FSETID)", |
| " - modify the data journaling mode on ext3 filesystem,", |
| " which uses journaling resources", |
| " - override size restrictions on IPC message queues", |
| " - configure more than 64Hz interrupts from the", |
| " real-time clock", |
| " - override the maximum number of consoles for console", |
| " allocation", |
| " - override the maximum number of keymaps", |
| NULL |
| }; |
| static const char *explanation25[] = { /* cap_sys_time = 25 */ |
| "Allows a process to perform time manipulation of clocks:", |
| " - alter the system clock", |
| " - enable irix_stime on MIPS", |
| " - set the real-time clock", |
| NULL |
| }; |
| static const char *explanation26[] = { /* cap_sys_tty_config = 26 */ |
| "Allows a process to manipulate tty devices:", |
| " - configure tty devices", |
| " - perform vhangup() of a tty", |
| NULL |
| }; |
| static const char *explanation27[] = { /* cap_mknod = 27 */ |
| "Allows a process to perform privileged operations with", |
| "the mknod() system call.", |
| NULL |
| }; |
| static const char *explanation28[] = { /* cap_lease = 28 */ |
| "Allows a process to take leases on files.", |
| NULL |
| }; |
| static const char *explanation29[] = { /* cap_audit_write = 29 */ |
| "Allows a process to write to the audit log via a", |
| "unicast netlink socket.", |
| NULL |
| }; |
| static const char *explanation30[] = { /* cap_audit_control = 30 */ |
| "Allows a process to configure audit logging via a", |
| "unicast netlink socket.", |
| NULL |
| }; |
| static const char *explanation31[] = { /* cap_setfcap = 31 */ |
| "Allows a process to set capabilities on files.", |
| "Permits a process to uid_map the uid=0 of the", |
| "parent user namespace into that of the child", |
| "namespace. Also, permits a process to override", |
| "securebits locks through user namespace", |
| "creation.", |
| NULL |
| }; |
| static const char *explanation32[] = { /* cap_mac_override = 32 */ |
| "Allows a process to override Manditory Access Control", |
| "(MAC) access. Not all kernels are configured with a MAC", |
| "mechanism, but this is the capability reserved for", |
| "overriding them.", |
| NULL |
| }; |
| static const char *explanation33[] = { /* cap_mac_admin = 33 */ |
| "Allows a process to configure the Mandatory Access", |
| "Control (MAC) policy. Not all kernels are configured", |
| "with a MAC enabled, but if they are this capability is", |
| "reserved for code to perform administration tasks.", |
| NULL |
| }; |
| static const char *explanation34[] = { /* cap_syslog = 34 */ |
| "Allows a process to configure the kernel's syslog", |
| "(printk) behavior.", |
| NULL |
| }; |
| static const char *explanation35[] = { /* cap_wake_alarm = 35 */ |
| "Allows a process to trigger something that can wake the", |
| "system up.", |
| NULL |
| }; |
| static const char *explanation36[] = { /* cap_block_suspend = 36 */ |
| "Allows a process to block system suspends - prevent the", |
| "system from entering a lower power state.", |
| NULL |
| }; |
| static const char *explanation37[] = { /* cap_audit_read = 37 */ |
| "Allows a process to read the audit log via a multicast", |
| "netlink socket.", |
| NULL |
| }; |
| static const char *explanation38[] = { /* cap_perfmon = 38 */ |
| "Allows a process to enable observability of privileged", |
| "operations related to performance. The mechanisms", |
| "include perf_events, i915_perf and other kernel", |
| "subsystems.", |
| NULL |
| }; |
| static const char *explanation39[] = { /* cap_bpf = 39 */ |
| "Allows a process to manipulate aspects of the kernel", |
| "enhanced Berkeley Packet Filter (BPF) system. This is", |
| "an execution subsystem of the kernel, that manages BPF", |
| "programs. CAP_BPF permits a process to:", |
| " - create all types of BPF maps", |
| " - advanced verifier features:", |
| " - indirect variable access", |
| " - bounded loops", |
| " - BPF to BPF function calls", |
| " - scalar precision tracking", |
| " - larger complexity limits", |
| " - dead code elimination", |
| " - potentially other features", |
| "", |
| "Other capabilities can be used together with CAP_BFP to", |
| "further manipulate the BPF system:", |
| " - CAP_PERFMON relaxes the verifier checks as follows:", |
| " - BPF programs can use pointer-to-integer", |
| " conversions", |
| " - speculation attack hardening measures can be", |
| " bypassed", |
| " - bpf_probe_read to read arbitrary kernel memory is", |
| " permitted", |
| " - bpf_trace_printk to print the content of kernel", |
| " memory", |
| " - CAP_SYS_ADMIN permits the following:", |
| " - use of bpf_probe_write_user", |
| " - iteration over the system-wide loaded programs,", |
| " maps, links BTFs and convert their IDs to file", |
| " descriptors.", |
| " - CAP_PERFMON is required to load tracing programs.", |
| " - CAP_NET_ADMIN is required to load networking", |
| " programs.", |
| NULL |
| }; |
| static const char *explanation40[] = { /* cap_checkpoint_restore = 40 */ |
| "Allows a process to perform checkpoint", |
| "and restore operations. Also permits", |
| "explicit PID control via clone3() and", |
| "also writing to ns_last_pid.", |
| NULL |
| }; |
| static const char **explanations[] = { |
| explanation0, |
| explanation1, |
| explanation2, |
| explanation3, |
| explanation4, |
| explanation5, |
| explanation6, |
| explanation7, |
| explanation8, |
| explanation9, |
| explanation10, |
| explanation11, |
| explanation12, |
| explanation13, |
| explanation14, |
| explanation15, |
| explanation16, |
| explanation17, |
| explanation18, |
| explanation19, |
| explanation20, |
| explanation21, |
| explanation22, |
| explanation23, |
| explanation24, |
| explanation25, |
| explanation26, |
| explanation27, |
| explanation28, |
| explanation29, |
| explanation30, |
| explanation31, |
| explanation32, |
| explanation33, |
| explanation34, |
| explanation35, |
| explanation36, |
| explanation37, |
| explanation38, |
| explanation39, |
| explanation40, |
| }; |
| #define CAPSH_DOC_LIMIT 41 |
