diff options
| author | Patrick Steinhardt | 2017-06-24 16:04:34 +0200 |
|---|---|---|
| committer | Karel Zak | 2017-06-27 14:59:19 +0200 |
| commit | 0c92194eeee9c1fd58580ef852c11eb1861d6dee (patch) | |
| tree | e85969c48be18e151759107839b3f227f4df038f /sys-utils/setpriv.1 | |
| parent | setpriv: support dumping ambient capabilities (diff) | |
| download | kernel-qcow2-util-linux-0c92194eeee9c1fd58580ef852c11eb1861d6dee.tar.gz kernel-qcow2-util-linux-0c92194eeee9c1fd58580ef852c11eb1861d6dee.tar.xz kernel-qcow2-util-linux-0c92194eeee9c1fd58580ef852c11eb1861d6dee.zip | |
setpriv: support modifying the set of ambient capabilities
Right now, we do not support modifying the set of ambient capabilities,
which has been introduced quite recently with Linux 4.3. As libcap-ng
does not yet provide any ability to modify this set, we do have to roll
our own support via `prctl`, which is now easy to do due to the
indirections introduced in the preceding commits. We add a new command
line argument "--ambient-caps", which uses the same syntax as both
"--inh-caps" and "--bounding-set" to specify either adding or dropping
capabilities.
This commit also adjusts documentation to mention the newly introduced
ability to modify the ambient capability set.
Based on a patch by Andy Lutomirski.
Reviewed-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Diffstat (limited to 'sys-utils/setpriv.1')
| -rw-r--r-- | sys-utils/setpriv.1 | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/sys-utils/setpriv.1 b/sys-utils/setpriv.1 index be97c0799..b0cc33a2b 100644 --- a/sys-utils/setpriv.1 +++ b/sys-utils/setpriv.1 @@ -27,8 +27,8 @@ mostly useless, information. Incompatible with all other options. .B \-\-groups \fIgroup\fR... Set supplementary groups. The argument is a comma-separated list. .TP -.BR \-\-inh\-caps " (" + | \- ) \fIcap "... or " \-\-bounding\-set " (" + | \- ) \fIcap ... -Set the inheritable capabilities or the capability bounding set. See +.BR \-\-inh\-caps " (" + | \- ) \fIcap "... or " \-\-ambient-caps " (" + | \- ) \fIcap "... or " \-\-bounding\-set " (" + | \- ) \fIcap ... +Set the inheritable capabilities, ambient capabilities or the capability bounding set. See .BR capabilities (7). The argument is a comma-separated list of .BI + cap @@ -40,7 +40,9 @@ and .B \-all can be used to add or remove all caps. The set of capabilities starts out as the current inheritable set for -.B \-\-inh\-caps +.BR \-\-inh\-caps , +the current ambient set for +.B \-\-ambient\-caps and the current bounding set for .BR \-\-bounding\-set . If you drop something from the bounding set without also dropping it from the |