1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
|
.\"
.\" $Id: capget.2,v 1.4 1999/09/09 16:43:26 morgan Exp $
.\" written by Andrew Morgan <morgan@linux.kernel.org>
.\" may be distributed as per GPL
.\" Modified by David A. Wheeler <dwheeler@ida.org>
.\" Modified 2004-05-27, mtk
.\" Modified 2004-06-21, aeb
.\"
.\" Japanese Version Copyright (c) 1999 HANATAKA Shinya
.\" all rights reserved.
.\" Translated 1999-12-26, HANATAKA Shinya <hanataka@abyss.rim.or.jp>
.\" Updated & Modified 2005-02-03, Yuichi SATO <ysato444@yahoo.co.jp>
.\" Updated & Modified 2006-01-31, Akihiro MOTOKI <amotoki@dd.iij4u.or.jp>
.\" Updated & Modified 2006-07-23, Akihiro MOTOKI, LDP v2.36
.\"
.\"WORD: capability ѥӥƥ
.\"WORD: effective capability ¸ѥӥƥ
.\"WORD: inheritable capabilit Ѿǽѥӥƥ
.\"WORD: permitted capabily ĥѥӥƥ
.\"
.TH CAPGET 2 2004-06-21 "Linux" "Linux Programmer's Manual"
.SH ̾
capget, capset \- ѥӥƥ/
.SH
.B #undef _POSIX_SOURCE
.br
.B #include <sys/capability.h>
.sp
.BI "int capget(cap_user_header_t " hdrp ", cap_user_data_t " datap );
.sp
.BI "int capset(cap_user_header_t " hdrp ", const cap_user_data_t " datap );
.SH
Linux 2.2 ǡѡ桼 (root) θ¤ϡ줾̤Υѥӥƥ
(capabilities) ؤʬ䤵졢νȤɽ褦ˤʤä
٤ƤΥåɤϡּ¸ѥӥƥ (effective capability) νפ
ˤäƸߤɤ¹Բǽ̤Ǥ롣
ޤ٤ƤΥåɤϡ
ַѾǽѥӥƥ (inheritable capability) νפ
ֵĥѥӥƥ (permitted capability) νפġ
ַѾǽѥӥƥνפ
.BR execve (2)
̤ϤȤǤ륱ѥӥƥνǤꡢ
ֵĥѥӥƥ (permitted capability) νפ
¸ѥӥƥѾǽѥӥƥͭˤǤ
ѥӥƥꤹΤǤ롣
.PP
Ĥδؿϥѥӥƥꤷꤹ뤿
ͥ륤եǤ롣Υƥॳ Linux ͭ
ȤΤߤʤ餺ͥ API ѹ뤫⤷줺
ؿλˡ (ä
.I cap_user_*_t
Ȥ) Ϥ줾ΥͥΥӥѹ뤫⤷ʤ
.sp
ܿΤ륤ե
.BR cap_set_proc (3)
.BR cap_get_proc (3)
Ǥ롣
ǽʤХץꥱϤδؿѤ٤Ǥ롣
ץꥱ Linux ĥѤˤϡñ
Ȥ륤եǤ
.BR capsetp (3)
.BR capgetp (3)
Ѥ٤Ǥ롣
.SS ߤξܺ
ߤΥͥξܺ٤ˤĤդҤ٤Ƥ
¤ΤϰʲΤ褦롣
.sp
.nf
.in +4n
#define _LINUX_CAPABILITY_VERSION 0x19980330
typedef struct __user_cap_header_struct {
int version;
int pid;
} *cap_user_header_t;
typedef struct __user_cap_data_struct {
int effective;
int permitted;
int inheritable;
} *cap_user_data_t;
.fi
.in -4n
.sp
.I hdrp
.I version
եɤ¾ΥСꤵ줿硢
θƤӽФ
.B EINVAL
֤Υեɤ
.B _LINUX_CAPABILITY_VERSION
ꤹ롣
.I hdrp
.I pid
եɤ 0 ʳξ硢
θƤӽФ
.I pid
ǻꤵ줿åɤΥѥӥƥоݤư롣
.I pid
0 ξϸƤӽФΥåɤΥѥӥƥоݤư롣
.I pid
륹åɡץȤƤ硢
.I pid
ϰȤƤץID ȤäƻǤ롣
ޥåɡץΤ륹åɤоݤˤϡ
.BR gettid (2)
֤åID Ѥƻꤹɬפ롣
ޤ
.BR capset ()
Ǥ \-1 \-1 꾮ͤꤹ뤳ȤǤ롣
\-1 ϸƤӽФ
.BR init (8)
ƤΥåɤоݤȤѹԤȤ
\-1 꾮ͤ ID \-\fIpid\fP Υץ롼פ
оݤȤѹԤȤ̣롣
Υǡξܺ٤
.BR capabilities (7)
Ȥ뤳ȡ
.SH ֤
ˤ 0 ֤顼ξˤ \-1 ֤
.I errno
Ŭڤꤹ롣
.SH 顼
.TP
.B EFAULT
ʥꥢɥ쥹
.I hdrp
.I datap
Τɤ⤬ NULL Ǥ롣
.TP
.B EINVAL
Τɤ줫̵Ǥ롣
.TP
.B EPERM
ֵĥѥӥƥåȡפ˥ѥӥƥɲä褦ȤƤ뤫
⤷ϡֵĥѥӥƥåȡפ˴ޤޤʤѥӥƥ
ּ¸ѥӥƥåȡפַѾǽѥӥƥåȡפ
åȤ褦ȤƤ롣
.TP
.B EPERM
ƤӽФʬʳΥåɤΥѥӥƥ
.BR capset ()
Ȥäƽ褦Ȥʬøʤä
.B CAP_SETPCAP
ѥӥƥɬפǤ롣
(С 2.6.11 Υͥˤϡ
Υѥӥƥʤåɤ
.I pid
եɤ 0 Ǥʤ (Ĥޤꡢ0
.BR getpid (2)
֤) ꤷƼʬȤΥѥӥƥѹ褦Ȥˤ⡢
Υ顼ȯȤХä)
.TP
.B ESRCH
Τ褦ʥåɤ¸ߤʤ
.SH
Υƥॳ Linux ȼǤ롣
.SH
ѥӥƥꤷꤹ뵡ǽΤΰܿ
ե
.I libcap
饤֥ˤä롣
Υ饤֥ϰʲǤ:
.br
.I ftp://ftp.kernel.org/pub/linux/libs/security/linux-privs
.SH Ϣ
.BR clone (2),
.BR gettid (2),
.BR capabilities (7)
|
