.\" Copyright (c) 2002 by Michael Kerrisk <mtk.manpages@gmail.com>
.\"
.\" Permission is granted to make and distribute verbatim copies of this
.\" manual provided the copyright notice and this permission notice are
.\" preserved on all copies.
.\"
.\" Permission is granted to copy and distribute modified versions of this
.\" manual under the conditions for verbatim copying, provided that the
.\" entire resulting derived work is distributed under the terms of a
.\" permission notice identical to this one.
.\"
.\" Since the Linux kernel and libraries are constantly changing, this
.\" manual page may be incorrect or out-of-date.  The author(s) assume no
.\" responsibility for errors or omissions, or for damages resulting from
.\" the use of the information contained herein.  The author(s) may not
.\" have taken the same level of care in the production of this manual,
.\" which is licensed free of charge, as they might when working
.\" professionally.
.\"
.\" Formatted or processed versions of this manual, if unaccompanied by
.\" the source, must acknowledge the copyright and authors of this work.
.\"
.\" 6 Aug 2002 - Initial Creation
.\" Modified 2003-05-23, Michael Kerrisk, <mtk.manpages@gmail.com>
.\" Modified 2004-05-27, Michael Kerrisk, <mtk.manpages@gmail.com>
.\" 2004-12-08, mtk Added O_NOATIME for CAP_FOWNER
.\" 2005-08-16, mtk, Added CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE
.\" 2008-07-15, Serge Hallyn <serue@us.bbm.com>
.\"     Document file capabilities, per-process capability
.\"     bounding set, changed semantics for CAP_SETPCAP,
.\"     and other changes in 2.6.2[45].
.\"     Add CAP_MAC_ADMIN, CAP_MAC_OVERRIDE, CAP_SETFCAP.
.\" 2008-07-15, mtk
.\"     Add text describing circumstances in which CAP_SETPCAP
.\"     (theoretically) permits a thread to change the
.\"     capability sets of another thread.
.\"     Add section describing rules for programmatically
.\"     adjusting thread capability sets.
.\"     Describe rationale for capability bounding set.
.\"     Document "securebits" flags.
.\"     Add text noting that if we set the effective flag for one file
.\"     capability, then we must also set the effective flag for all
.\"     other capabilities where the permitted or inheritable bit is set.
.\"
.\" Japanese Version Copyright (c) 2005 Akihiro MOTOKI all rights reserved.
.\" Translated 2005-03-09, Akihiro MOTOKI <amotoki@dd.iij4u.or.jp>
.\" Updated 2005-11-04, Akihiro MOTOKI
.\" Updated 2006-04-16, Akihiro MOTOKI, LDP v2.29
.\" Updated 2006-07-20, Akihiro MOTOKI, LDP v2.34
.\" Updated 2007-01-05, Akihiro MOTOKI, LDP v2.43
.\" Updated 2008-12-24, Akihiro MOTOKI, LDP v3.15
.\" Updated 2009-02-27, Akihiro MOTOKI, LDP v3.19
.\"
.TH CAPABILITIES 7 2008-11-27 "Linux" "Linux Programmer's Manual"
.SH ̾
capabilities \- Linux Υѥӥƥ (capability) γ
.SH 
¤ΥåԤ鸫ȡŪ Unix μǤ
ץĤΥƥʬǤ:
.I ø
ץ (¸桼ID  0 Υץ桼ID 0 
ѡ桼 root ȸƤФ) 
.I ø
ץ (¸桼ID  0 ʳΥץ) Ǥ롣
øץǤϡץλʾ (̾ϡ¸UID ¸GID
ɲäΥ롼ץꥹ) ˴Ť¥åԤΤФ
øץǤƤΥͥθ¥åХѥ롣

С 2.2 ʹߤ Linux Ǥϡ
ޤǥѡ桼˷դƤ¤
ĤΥ롼פʬ䤷Ƥ롣Υ롼פ
.IR ѥӥƥ (capability)
ȸƤФ졢롼Ω̵ͭǤ롣
ѥӥƥϥåñ̤°Ǥ롣
.\"
.SS ѥӥƥΥꥹ
ʲΥꥹȤϡ
Linux ǼƤ륱ѥӥƥ
ƥѥӥƥĤưޤȤ᤿ΤǤ롣
.TP
.BR CAP_AUDIT_CONTROL " (Linux 2.6.11 ʹ)"
ͥƺ (audit) ̵ͭڤؤ
ƺΥե륿롼ѹ
ƺξե륿롼μǤ롣
.TP
.BR CAP_AUDIT_WRITE " (Linux 2.6.11 ʹ)"
ͥƺΥ˥쥳ɤ񤭹ࡣ
.TP
.B CAP_CHOWN
ե UID GID Ǥդѹ
.RB ( chown (2)
)
.TP
.B CAP_DAC_OVERRIDE
եɤ߽Ф񤭹ߡ¹Ԥθ¥åХѥ
(DAC  "discretionary access control (ǤդΥ)" άǤ)
.TP
.B CAP_DAC_READ_SEARCH
եɤ߽Ф¤Υåȥǥ쥯ȥɤ߽Фȼ¹
θ¥åХѥ롣
.TP
.B CAP_FOWNER
.PD 0
.RS
.IP * 2
̾ץΥե륷ƥ UID ե UID ˰פ뤳Ȥ
׵ᤵ (㤨
.BR chmod (2),
.BR utime (2))
ˤ븢¥åХѥ롣
â
.B CAP_DAC_OVERRIDE

.B CAP_DAC_READ_SEARCH
ˤåԤϽ
.IP *
ǤդΥեФƳĥե°ꤹ
.RB ( chattr (1)
)
.IP *
ǤդΥեФƥꥹ (ACL) ꤹ롣
.IP *
եκκݤ˥ǥ쥯ȥΥƥåӥåȤ̵뤹롣
.IP *
.BR open (2)

.BR fcntl (2)
ǤդΥեФ
.B O_NOATIME
ꤹ롣
.RE
.PD
.TP
.B CAP_FSETID
ե뤬ѹ줿Ȥ set-user-ID set-group-ID εĥӥåȤ򥯥ꥢ
ʤƤӽФץΥե륷ƥ GID ɲä GID ΤȤ
GID פʤեФ set-group-ID ӥåȤꤹ롣
.TP
.B CAP_IPC_LOCK
꡼Υå
.RB ( mlock (2),
.BR mlockall (2),
.BR mmap (2),
.BR shmctl (2))
Ԥ
.TP
.B CAP_IPC_OWNER
System V IPC ֥ȤФ˴ؤƸ¥åХѥ롣
.TP
.B CAP_KILL
ʥݤ˸¥åХѥ
.RB ( kill (2)
)ˤ
.BR ioctl (2)

.B KDSIGACCEPT
λѤޤޤ롣
.\" FIXME CAP_KILL also has an effect for threads + setting child
.\"       termination signal to other than SIGCHLD: without this
.\"       capability, the termination signal reverts to SIGCHLD
.\"       if the child does an exec().  What is the rationale
.\"       for this?
.TP
.BR CAP_LEASE " (Linux 2.4 ʹ)"
ǤդΥեФ
ե꡼ꤹ
.RB ( fcntl (2)
)
.TP
.B CAP_LINUX_IMMUTABLE
ĥե°
.B FS_APPEND_FL

.B FS_IMMUTABLE_FL
ꤹ
.RB ( chattr (1)
)
.\" ° ext2, ext3, Reiserfs, XFS, JFS ѲǽǤ롣
.TP
.BR CAP_MAC_ADMIN " (Linux 2.6.25 ʹ)"
 (MAC) 񤭤롣
Smack Linux Security Module (LSM) Ѥ˼Ƥ롣
.TP
.BR CAP_MAC_OVERRIDE " (Linux 2.6.25 ʹ)"
MAC ֤ѹ롣
Smack LSM Ѥ˼Ƥ롣
.TP
.BR CAP_MKNOD " (Linux 2.4 ʹ)"
(Linux 2.4 ʹ)
.BR mknod (2)
Ѥƥڥ롦ե롣
.TP
.B CAP_NET_ADMIN
ƼΥͥåȥϢ¹Ԥ롣
(㤨Сøɬפʥåȥץꤹ롢ޥ㥹Ȥͭˤ롢
󥿡եꤹ롢롼ƥ󥰥ơ֥ѹʤ)
.TP
.B CAP_NET_BIND_SERVICE
󥿡ͥåȥɥᥤøݡ (ݡֹ椬 1024 ̤)
ХɤǤ롣
.TP
.B CAP_NET_BROADCAST
(̤) åȤΥ֥ɥ㥹Ȥȡޥ㥹ȤԤԤ
.TP
.B CAP_NET_RAW
RAW åȤ PACKET åȤѤ롣
.\" ޤƼ IP ץ SO_BINDTODEVICE åȥץѤǤ롣
.TP
.B CAP_SETGID
ץ GID ɲä GID ꥹȤФǤդԤ
Unix ɥᥤ󥽥åȷͳǥåȤλʾ (credential) Ϥݤ
 GID ϤȤǤ롣
.TP
.BR CAP_SETFCAP " (Linux 2.6.24 ʹ)"
ե륱ѥӥƥꤹ롣
.TP
.B CAP_SETPCAP
ե륱ѥӥƥݡȤƤʤ:
ƤӽФĤƤ륱ѥӥƥåȤ˴ޤޤǤդΥѥӥƥ
¾ΥץͿꡢǤ롣
(ͥ뤬ե륱ѥӥƥ򥵥ݡȤƤ硢
.B CAP_SETPCAP
Ϥʤ
ʤʤ顢ե륱ѥӥƥ򥵥ݡȤƤ륫ͥǤ
.B CAP_SETPCAP
̤ΰ̣ĤǤ롣)

ե륱ѥӥƥݡȤƤ:
ƤӽФåɤΥХǥ󥰥åȤǤդΥѥӥƥ
ȤηѾǽѥӥƥåȤɲäǤ롣
.RB ( prctl (2)
.BR PR_CAPBSET_DROP
Ȥä)
Хǥ󥰥åȤ饱ѥӥƥǤ롣
.I securebits
ե饰ѹǤ롣
.TP
.B CAP_SETUID
ץ UID ФǤդ
.RB ( setuid (2),
.BR setreuid (2),
.BR setresuid (2),
.BR setfsuid (2))
Ԥ
Unix ɥᥤ󥽥åȷͳǥåȤλʾ (credential) Ϥݤ
 UID ϤȤǤ롣
.\" FIXME CAP_SETUID also an effect in exec(); document this.
.TP
.B CAP_SYS_ADMIN
.PD 0
.RS
.IP * 2
ʲΥƥѤ¹Ԥ:
.BR quotactl (2),
.BR mount (2),
.BR umount (2),
.BR swapon (2),
.BR swapoff (2),
.BR sethostname (2),
.BR setdomainname (2).
.IP *
Ǥդ System V IPC ֥ȤФ
.B IPC_SET

.B IPC_RMID
¹Ԥ롣
.IP *
ĥ°
.I trusted

.I security
Ф¹Ԥ
.RB ( attr (5)
)
.IP *
.BR lookup_dcookie (2)
ƤӽФ
.IP *
.BR ioprio_set (2)
Ȥä I/O 塼󥰥饹
.BR IOPRIO_CLASS_RT ,
.B IOPRIO_CLASS_IDLE
Ƥ
.RB ( IOPRIO_CLASS_IDLE
 Linux 2.6.25 ΥСΤ)
.IP *
åȤλʾ (credential) Ϥݤ˵ UID Ϥ
.IP *
ե򥪡ץ󤹤륷ƥॳ (㤨
.BR accept (2),
.BR execve (2),
.BR open (2),
.BR pipe (2))
ǥƥΤǥץǤեξ
.I /proc/sys/fs/file-max
Ķ᤹롣
.IP *
.BR clone (2)

.BR unshare (2)

.B CLONE_NEWNS
ե饰Ѥ롣
.IP *
.BR keyctl (2)

.B KEYCTL_CHOWN

.B KEYCTL_SETPERM
¹Ԥ롣
.RE
.PD
.TP
.B CAP_SYS_BOOT
.BR reboot (2)

.BR kexec_load (2)
ƤӽФ
.TP
.B CAP_SYS_CHROOT
.BR chroot (2).
ƤӽФ
.TP
.B CAP_SYS_MODULE
ͥ⥸塼ΥɡɤԤ
.RB ( init_module (2)

.BR delete_module (2)
򻲾ȤΤ)
С 2.6.25 Υͥǡ
ƥΤΥѥӥƥХǥ󥰥å (capability bounding set)
饱ѥӥƥ򳰤
.TP
.B CAP_SYS_NICE
.PD 0
.RS
.IP * 2
ץ nice ͤΰ夲
.RB ( nice (2),
.BR setpriority (2))
䡢ǤդΥץ nice ͤѹԤ
.IP *
ƤӽФץФꥢ륿ࡦ塼󥰥ݥꥷȡ
ǤդΥץФ륹塼󥰥ݥꥷͥ٤ꤹ
.RB ( sched_setscheduler (2),
.BR sched_setparam (2))
.IP *
ǤդΥץФ CPU affinity Ǥ
.RB ( sched_setaffinity (2))
.IP *
ǤդΥץФ I/O 塼󥰥饹ͥ٤Ǥ
.RB ( ioprio_set (2))
.IP *
.BR migrate_pages (2)
ǤդΥץŬѤץǤդΥΡɤ˰ư롣
.\" FIXME CAP_SYS_NICE also has the following effect for
.\" migrate_pages(2):
.\"     do_migrate_pages(mm, &old, &new,
.\"         capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
.IP *
.BR move_pages (2)
ǤդΥץФƹԤ
.IP *
.BR mbind (2)

.BR move_pages (2)

.B MPOL_MF_MOVE_ALL
ե饰Ѥ롣
.RE
.PD
.TP
.B CAP_SYS_PACCT
.BR acct (2)
ƤӽФ
.TP
.B CAP_SYS_PTRACE
.BR ptrace (2)
ȤäǤդΥץȥ졼롣
.TP
.B CAP_SYS_RAWIO
I/O ݡ¹Ԥ
.RB ( iopl (2)

.BR ioperm (2))
.I /proc/kcore
˥Ǥ롣
.TP
.B CAP_SYS_RESOURCE
.PD 0
.RS
.IP * 2
ext2 ե륷ƥͽ󤵤ƤΰѤ롣
.IP *
ext3 Υ㡼ʥ뵡ǽ椹
.BR ioctl (2)
Ѥ롣
.IP *
ǥ quota ξ¤񤭤롣
.IP *
꥽¤䤹
.RB ( setrlimit (2))
.IP *
.B RLIMIT_NPROC
꥽¤񤭤롣
.IP *
å塼˴ؤ
.I msg_qbytes

.I /proc/sys/kernel/msgmnb
˻ꤵƤ¤礭ꤹ
.RB ( msgop (2)

.BR msgctl (2)
)
.RE
.PD
.TP
.B CAP_SYS_TIME
ƥ९åѹ
.RB ( settimeofday (2),
.BR stime (2),
.BR adjtimex (2))
ꥢ륿 (ϡɥ) åѹ롣
.TP
.B CAP_SYS_TTY_CONFIG
.BR vhangup (2)
ƤӽФ
.\"
.SS ȸߤμ
ʷΥѥӥƥˤϡʲ׷ɬפ롧
.IP 1. 3
ƤøˤĤơͥϤΥåɤμ¸ѥӥƥåȤ
ɬפʥѥӥƥ뤫ǧ롣
.IP 2.
ͥǡ륹åɤΥѥӥƥåȤѹꡢ
Ǥ륷ƥॳ뤬󶡤롣
.IP 3.
ե륷ƥब¹Բǽե˥ѥӥƥͿǤե
¹ԻˤΥѥӥƥץǤ褦ʵǽ򥵥ݡȤ롣
.PP
ͥ 2.6.24 Ǥϡǽ 2Ĥ׷ΤߤƤ롣
ͥ 2.6.24 ʹߤǤϡ3Ĥ׷魯٤ƤƤ롣
.\"
.SS åɥѥӥƥå
ƥåɤϰʲ 3ΥѥӥƥåȤġơΥѥӥƥåȤ
嵭ΥѥӥƥȤ߹碌Ǥ (ƤΥѥӥƥ̵Ǥ褤)
.TP
.IR " (permitted)" :
ΥåɤĤȤˤʤäƤ¸ѥӥƥ
ŪʥѡåȤǤ롣
ϡ¸ѥӥƥåȤ
.B CAP_SETPCAP
ѥӥƥäƤʤåɤѾǽѥӥƥåȤ
ɲòǽʥѥӥƥθŪʥѡåȤǤ⤢롣

ĥѥӥƥåȤƤޤäѥӥƥϡ
(set-user-ID-root ץफ
Υѥӥƥե륱ѥӥƥǵĤƤץ
.BR execve (2)
ʤ¤) ⤦ٳ뤳ȤϤǤʤ
.TP
.IR "Ѿǽ (inheritable)" :
.BR execve (2)
ݻ륱ѥӥƥåȤǤ롣
λȤߤȤȤǡץ
.BR execve (2)
Ԥݤ˿ץεĥѥӥƥåȤȤ
Ƥ륱ѥӥƥꤹ뤳ȤǤ롣
.TP
.IR "¸ (effective)" :
ͥ뤬åɤθ (permission) åȤ
Ѥ륱ѥӥƥåȤǤ롣
.PP
.BR fork (2)
ǺҥץϡƤΥѥӥƥåȤΥԡѾ롣
.BR execve (2)
ΥѥӥƥΰˤĤƤϲ򻲾ȤΤȡ
.PP
.BR capset (2)
ȤȡץϼʬȤΥѥӥƥå
뤳ȤǤ ()
.\"
.SS ե륱ѥӥƥ
ͥ 2.6.24 ʹߤǤϡ
.BR setcap (8)
ȤäƼ¹ԥե˥ѥӥƥåȤбդ뤳ȤǤ롣
ե륱ѥӥƥåȤ
.I "security.capability"
Ȥ̾γĥ°¸
.RB ( setxattr (2)
)γĥ°ؤν񤭹ߤˤ
.B CAP_SETFCAP
ѥӥƥɬפǤ롣
ե륱ѥӥƥåȤȥåɤΥѥӥƥåȤξ
θ졢
.BR execve (2)
ΥåɤΥѥӥƥåȤꤵ롣

3 ĤΥե륱ѥӥƥåȤƤ롣
.TP
.IR " (Permitted)" " (" " (Forced)" "):"
åɤηѾǽѥӥƥ˴ؤ餺Υåɤ˼ưŪ
ǧ륱ѥӥƥ
.TP
.IR "Ѿǽ (Inheritable)" " ( " " (Allowed)" "):"
ΥåȤȡåɤηѾǽѥӥƥåȤȤ
 (AND) Ȥ졢
.BR execve (2)
θˤΥåɤεĥѥӥƥåȤͭȤʤ
Ѿǽѥӥƥꤵ롣
.TP
.IR "¸ (Effective)" :
ϽǤϤʤ1 ӥåȤξǤ롣
ΥӥåȤåȤƤȡ
.BR execve (2)
¹ˡΥåɤοĥѥӥƥ
¸ѥӥƥˤƤ⥻åȤ롣
ΥӥåȤåȤƤʤ硢
.BR execve (2)
ˤϿĥѥӥƥΤɤ⿷¸ѥӥƥ
˥åȤʤ

եμ¸ѥӥƥӥåȤͭˤȤΤϡ
.BR execve (2)
¹ԻˡեεĥѥӥƥȷѾѥӥƥбΤ
åɤεĥѥӥƥåȤȤƥåȤ뤬
줬¸ѥӥƥåȤˤ⥻åȤȤȤǤ
(ѥӥƥѴ롼ϲ)
äơե˥ѥӥƥƤ
.RB ( setcap (8),
.BR cap_set_file (3),
.BR cap_set_fd (3))
줫ΥѥӥƥФƼ¸ե饰ͭȻꤹ硢
ĥե饰Ѿǽե饰ͭˤ¾ƤΥѥӥƥ
ˤĤƤ¸ե饰ͭȻꤷʤФʤʤ
.\"
.SS "execve() ΥѥӥƥѴ"
.PP
.BR execve (2)
¹Իˡͥϥץοѥӥƥ򼡤
르ꥺѤƷ׻롧
.in +4n
.nf

P'(permitted) = (P(inheritable) & F(inheritable)) |
                (F(permitted) & cap_bset)

P'(effective) = F(effective) ? P'(permitted) : 0

P'(inheritable) = P(inheritable)    [Ĥޤꡢѹʤ]

.fi
.in
ѿΰ̣ϰʲ̤:
.RS 4
.IP P 10
.BR execve (2)
ΥåɤΥѥӥƥåȤ
.IP P'
.BR execve (2)
ΥåɤΥѥӥƥåȤ
.IP F
ե륱ѥӥƥåȤ
.IP cap_bset
ѥӥƥХǥ󥰥åȤ ()
.RE
.\"
.SS ѥӥƥȡ롼Ȥˤץμ¹
.BR execve (2)
ˡѥӥƥåȤȤäơƤθ¤ä
.I root
¸ˤϡʲΤ褦ˤ롣
.IP 1. 3
set-user-ID-root ץब¹Ԥ硢
ޤϥץμ¥桼 ID  0 (root) ξ硢
եηѾǽåȤȵĥåȤ 1
(ƤΥѥӥƥͭ) 롣
.IP 2.
set-user-ID-root ץब¹Ԥ硢
եμ¸ѥӥƥӥåȤ 1 (enabled) 롣
.PP
嵭Υ롼˥ѥӥƥѴŬѤ̤ޤȤȡ
ץ set-user-ID-root ץ
.BR execve (2)
硢ޤϼ¸ UID  0 Υץץ
.BR execve (2)
硢Ĥȼ¸ΥѥӥƥåȤѥӥƥ
(ΤˤϡѥӥƥХǥ󥰥åȤˤޥǽ
ʳƤΥѥӥƥ) ȤȤǤ롣
.\"  UID  0 Ǽ¸ UID  0 ʳΥץ exec () Ԥȡ
.\" ĥѥӥƥåȤ˴ޤޤƤΥѥӥƥ
.\" 졢¸ѥӥƥϼʤ
ˤꡢŪ Unix ƥƱ񤤤Ǥ褦ˤʤäƤ롣
.SS ѥӥƥХǥ󥰥å
ѥӥƥХǥ󥰥å (capability bounding set) ϡ
.BR execve (2)
˳Ǥ륱ѥӥƥ¤뤿˻Ȥ
ƥǤ롣
Хǥ󥰥åȤϰʲΤ褦˻Ѥ롣
.IP * 2
.BR execve (2)
¹ԻˡѥӥƥХǥ󥰥åȤ
եεĥѥӥƥåȤ (AND) äΤ
ΥåɤεĥѥӥƥåȤ˳Ƥ롣
ĤޤꡢѥӥƥХǥ󥰥åȤϡ
¹ԥե뤬ǧƤĥѥӥƥФ
¤ݤƯ򤹤롣
.IP *
(Linux 2.6.25 ʹ)
ѥӥƥХǥ󥰥åȤϡåɤ
.BR capset (2)
ˤ꼫ȤηѾǽåȤɲòǽʥѥӥƥ콸Ĥ
¤ġ
åɤ˵Ĥ줿ѥӥƥǤäƤ⡢Хǥ󥰥åȤ
ޤޤƤʤСåɤϤΥѥӥƥϼȤηѾǽåȤ
ɲäǤη̡ѾǽåȤˤΥѥӥƥޤե
.BR execve (2)
ΥѥӥƥĥåȤ˻³뤳ȤǤ롢
ȤȤǤ롣
.PP
Хǥ󥰥åȤޥԤΤϡѾǽѥӥƥǤϤʤ
եεĥѥӥƥΥޥԤդ뤳ȡ
륹åɤηѾǽåȤˤΥåɤΥХǥ󥰥åȤ
¸ߤʤѥӥƥޤޤƤ硢Υåɤϡ
ѾǽåȤ˴ޤޤ륱ѥӥƥĥե¹Ԥ뤳Ȥˤꡢ
ĥåȤ˴ޤޤ륱ѥӥƥǤȤȤǤ롣
.PP
ͥΥСˤꡢѥӥƥХǥ󥰥åȤ
ƥඦ̤°ξȡץñ̤°ξ礬롣
.PP
.B "Linux 2.6.25 ΥѥӥƥХǥ󥰥å"
.PP
2.6.25 ΥͥǤϡѥӥƥХǥ󥰥åȤ
ƥඦ̤°ǡƥƤΥåɤŬѤ롣
Хǥ󥰥åȤ
.I /proc/sys/kernel/cap-bound
եͳǻȤǤ롣
(ְ㤨䤹ΥӥåȥޥΥѥ᡼ϡ
.I /proc/sys/kernel/cap-bound
Ǥդνʿɽ롣)

.B init
ץѥӥƥХǥ󥰥åȤ
ѥӥƥ򥻥åȤ뤳ȤǤ롣
ʳǤϡѡ桼 (Τˤϡ
.B CAP_SYS_MODULE
ѥӥƥäץ) 
ѥӥƥХǥ󥰥åȤΥѥӥƥΥꥢ
ǤǤ롣

̾ΥƥǤϡѥӥƥХǥ󥰥åȤϡ
.B CAP_SETPCAP
̵ˤʤäƤ롣
¤ˤ (Τϴ!)
.I include/linux/capability.h

.B CAP_INIT_EFF_SET
ͥƹۤɬפ롣

ƥඦ̤ΥѥӥƥХǥ󥰥åȵǽϡ
ͥ 2.2.11 ʹߤ Linux ɲä줿
.\"
.PP
.B "Linux 2.6.25 ʹߤΥѥӥƥХǥ󥰥å"
.PP
Linux 2.6.25 ʹߤǤϡ
֥ѥӥƥХǥ󥰥åȡפϥåñ̤°Ǥ
(ƥඦ̤ΥѥӥƥХǥ󥰥åȤϤϤ¸ߤʤ)

Хǥ󥰥åȤ
.BR fork (2)
ˤϥåɤοƥץѾ졢
.BR execve (2)
Ǥݻ롣

åɤ
.B CAP_SETPCAP
ѥӥƥäƤ硢Υåɤ
.BR prctl (2)

.BR PR_CAPBSET_DROP
ȤäƼȤΥѥӥƥХǥ󥰥åȤ
ѥӥƥ뤳ȤǤ롣
ä󥱡ѥӥƥХǥ󥰥åȤƤޤȡ
åɤϤΥѥӥƥ٥åȤ뤳ȤϤǤʤ
.BR prctl (2)

.B PR_CAPBSET_READ
ȤȤǡåɤ륱ѥӥƥȤΥХǥ󥰥å
˴ޤޤƤ뤫Τ뤳ȤǤ롣

Хǥ󥰥åȤΥѥӥƥκݡȤΤϡ
ͥΥѥ˥ե륱ѥӥƥͭˤʤäƤ
(CONFIG_SECURITY_FILE_CAPABILITIES) Ǥ롣
ξˤϡ (ƤΥץĤǤ) 
.I init
ץϥХǥ󥰥åȤƤΥѥӥƥ
åȤ줿֤dzϤ롣
ե륱ѥӥƥͭˤʤäƤʤˤϡ
.I init
ϥХǥ󥰥åȤ
.B CAP_SETPCAP
ʳƤΥѥӥƥåȤ줿֤dzϤ롣
Τ褦ˤʤäƤΤϡ
.B CAP_SETPCAP
ѥӥƥե륱ѥӥƥݡȤƤʤˤ
ạ̈ĤǤ롣

Хǥ󥰥åȤ饱ѥӥƥƤ⡢
åɤηѾǽåȤϤΥѥӥƥϺʤ
ʤ顢Хǥ󥰥åȤκˤꡢ
褽Υѥӥƥ򥹥åɤηѾǽåȤɲä뤳
ϤǤʤʤ롣
.\"
.\"
.SS "桼 ID ѹΥѥӥƥؤαƶ"
桼 ID  0  0 ʳδ֤Ѳݤο񤤤Ʊˤ뤿ᡢ
åɤμ UID¸ UID¸ set-user-IDե륷ƥ UID 
.RB ( setuid (2),
.BR setresuid (2)
ʤɤȤä) ѹ줿ݤˡͥϤΥåɤΥѥӥƥåȤ
ʲѹԤ:
.IP 1. 3
UID ѹˤϼ UID¸ UID¸ set-user-ID Τ
ʤȤĤ 0 ǡѹ˼ UID¸ UID¸ set-user-ID 
٤ 0 ʳͤˤʤä硢Ĥȼ¸ΥѥӥƥåȤ
ѥӥƥ򥯥ꥢ롣
.IP 2.
¸ UID  0  0 ʳѹ줿硢
¸ѥӥƥåȤѥӥƥ򥯥ꥢ롣
.IP 3.
¸ UID  0 ʳ 0 ѹ줿硢
ĥѥӥƥåȤƤ¸ѥӥƥåȤ˥ԡ롣
.IP 4.
ե륷ƥ UID  0  0 ʳѹ줿
.RB ( setfsuid (2)
)¸ѥӥƥåȤΰʲΥѥӥƥꥢ:
.BR CAP_CHOWN ,
.BR CAP_DAC_OVERRIDE ,
.BR CAP_DAC_READ_SEARCH ,
.BR CAP_FOWNER ,
.BR CAP_FSETID ,
.BR CAP_MAC_OVERRIDE .
ե륷ƥ UID  0 ʳ 0 ѹ줿硢
嵭ΥѥӥƥΤĥѥӥƥåȤͭˤʤäƤΤ
¸ѥӥƥåȤͭˤ롣
.PP
Ƽ UID ΤʤȤĤ 0 Ǥ륹åɤ
 UID Ƥ 0 ʳˤʤäȤ˵ĥѥӥƥåȤ
ꥢʤ褦ˤˤϡ
.BR prctl (2)

.B PR_SET_KEEPCAPS
ȤФ褤
.\"
.SS ץǥѥӥƥåȤĴ
ƥåɤϡ
.BR capget (2)

.BR capset (2)
ȤäơȤΥѥӥƥåȤѹǤ롣
Ԥˤϡ
.I libcap
ѥå󶡤Ƥ
.BR cap_get_proc (3)

.BR cap_set_proc (3)
ȤΤ˾ޤ
åɤΥѥӥƥåȤѹˤϰʲΥ롼뤬ŬѤ롣
.IP 1. 3
ƤӽФ¦
.B CAP_SETPCAP
ѥӥƥäƤʤ硢ѾǽåȤϡ
¸ηѾǽåȤȵĥåȤѽ (AND) ʬ
ʤФʤʤ
.IP 2.
(ͥ 2.6.25 ʹ)
ѾǽåȤϡ¸ηѾǽåȤȥѥӥƥ
Хǥ󥰥åȤѽ (AND) ʬǤʤФʤʤ
.IP 3.
ĥåȤϡ¸εĥåȤʬǤʤФʤʤ
(ĤޤꡢΥåɤ߻äƤʤĥѥӥƥ
뤳ȤϤǤʤ)
.IP 4.
¸ѥӥƥåȤϿĥѥӥƥåȤ
ʬˤʤäƤʤФʤʤ
.SS securebits ե饰: ѥӥƥδĶۤ
.\" For some background:
.\"       see http://lwn.net/Articles/280279/ and
.\"       http://article.gmane.org/gmane.linux.kernel.lsm/5476/
ͥ 2.6.26 ʹߤǡ
ե륱ѥӥƥͭˤʤäͥǤϡ
åñ̤
.I securebits
ե饰ƤꡢΥե饰Ȥ UID 0
.RI ( root )
Ф륱ѥӥƥ̵̰뤳ȤǤ롣
ʲΤ褦ʥե饰롣
.TP
.B SECURE_KEEP_CAPS
Υե饰򥻥åȤƤ硢UID  0 Υåɤ UID  0 ʳͤ
ڤؤݤˡΥåɤϥѥӥƥݻ뤳ȤǤ롣
Υե饰åȤƤʤˤϡUID  0  0 ʳͤ
ڤؤȡΥåɤƤΥѥӥƥ򼺤
Υե饰
.BR execve (2)
ˤƥꥢ
(Υե饰ϡ
.BR prctl (2)

.B PR_SET_KEEPCAPS
Ʊǽ󶡤ΤǤ)
.TP
.B SECURE_NO_SETUID_FIXUP
Υե饰򥻥åȤȡåɤμ¸ UID ȥե륷ƥ UID 
0  0 ʳδ֤ڤؤäˡ
ͥϥѥӥƥåȤĴԤʤʤ
(֥桼 ID ѹΥѥӥƥؤαƶפ򻲾)
.TP
.B SECURE_NOROOT
ΥӥåȤåȤƤ硢
set-user-ID-root ץμ¹Ի䡢
¸ UID   UID  0 Υץ
.BR execve (2)
ƤӽФˡͥϥѥӥƥĤʤ
(֥ѥӥƥȡ롼Ȥˤץμ¹ԡפ򻲾)
.PP
嵭 "base" ե饰γơˤб "locked" ե饰¸ߤ롣
 "locked" ե饰٥åȤ᤹ȤϤǤ
ʹߤб "base" ե饰ѹ뤳ȤǤʤʤ롣
"locked" ե饰
.BR SECURE_KEEP_CAPS_LOCKED ,
.BR SECURE_NO_SETUID_FIXUP_LOCKED ,
.BR SECURE_NOROOT_LOCKED
Ȥ̾Ǥ롣
.PP
.I securebits
ե饰ϡ
.BR prctl (2)

.B PR_SET_SECUREBITS

.B PR_GET_SECUREBITS
ȤȤѹǤ롣
ե饰ѹˤ
.B CAP_SETPCAP
ѥӥƥɬפǤ롣

.I securebits
ե饰ϻҥץ˷Ѿ롣
.BR execve (2)
ˤƤϡ
.B SECURE_KEEP_CAPS
˥ꥢʳϡƤΥե饰ݻ롣

ץꥱϡʲθƤӽФԤȤˤꡢ
ʬȤӻ¹ȤʤץƤФơ
ɬפʥե륱ѥӥƥäץ¹Ԥʤ¤ꡢ
б륱ѥӥƥǤʤ褦ʾĤ뤳ȤǤ롣
.in +4n
.nf

prctl(PR_SET_SECUREBITS,
        1 << SECURE_KEEP_CAPS_LOCKED |
        1 << SECURE_NO_SETUID_FIXUP |
        1 << SECURE_NO_SETUID_FIXUP_LOCKED |
        1 << SECURE_NOROOT |
        1 << SECURE_NOROOT_LOCKED);
.fi
.in
.SH 
.PP
ѥӥƥ˴ؤɸϤʤ Linux ΥѥӥƥѰƤˤʤä
POSIX.1e Ƥ˴ŤƼƤ롣
.I http://wt.xpilot.org/publications/posix.1e/
򻲾ȡ
.SH 
ͥ 2.5.27 ʹߡѥӥƥ򼰤Υͥ륳ݡͥ
ȤʤäƤꡢͥꥪץ CONFIG_SECURITY_CAPABILITIES
ˤͭ/̵ڤؤ뤳ȤǤ롣

.I /proc/PID/task/TID/status
եȤȡåɤΥѥӥƥåȤ򸫤뤳ȤǤ롣
.I /proc/PID/status
եˤϡץΥᥤ󥹥åɤΥѥӥƥåȤɽ롣

.I libcap
ѥåϡѥӥƥꡦ뤿
롼󷲤󶡤Ƥ롣Υ󥿥եϡ
.BR capset (2)

.BR capget (2)
󶡤륤󥿡ե٤ơȤ䤹ѹǽʤ
ΥѥåǤϡ
.BR setcap (8),
.BR getcap (8)
Ȥץ󶡤Ƥ롣
ѥå
.I http://www.kernel.org/pub/linux/libs/security/linux-privs
Ǥ롣

С 2.6.24 ӥե륱ѥӥƥ
ͭˤʤäƤʤ2.6.24 ʹߤΥͥǤϡ
.B CAP_SETPCAP
ѥӥƥäåɤϼʬʳΥåɤ
ѥӥƥǤ롣
ʤ顢Ū˲ǽȤǤ롣
ʲΤ줫ξˤƤ⡢ɤΥåɤ
.BR CAP_SETPCAP
ѥӥƥĤȤϤʤǤ롣
.IP * 2
2.6.25 μǤϡƥඦ̤ΥѥӥƥХǥ󥰥å
.I /proc/sys/kernel/cap-bound
ǤϤΥѥӥƥϾ̵ˤʤäƤꡢ
ѹƥͥƥѥ뤷ʤ¤ꡢ
ѹ뤳ȤϤǤʤ
.IP *
ߤμǤϥե륱ѥӥƥ̵ˤʤäƤ硢
ץΥХǥ󥰥åȤ餳Υѥӥƥȴ
.B init
ϳϤ졢
ƥ¾ƤΥץǤΥХǥ󥰥åȤ
Ѿ롣
.SH Ϣ
.BR capget (2),
.BR prctl (2),
.BR setfsuid (2),
.BR cap_clear (3),
.BR cap_copy_ext (3),
.BR cap_from_text (3),
.BR cap_get_file (3),
.BR cap_get_proc (3),
.BR cap_init (3),
.BR capgetp (3),
.BR capsetp (3),
.BR credentials (7),
.BR pthreads (7),
.BR getcap (8),
.BR setcap (8)
.PP
ͥ륽
.I include/linux/capability.h