MAN page from CentOS 8 libcap-2.26-4.el8.x86_64.rpm
Section: User Commands (1)
capsh - capability shell wrapper
Linux capability support and use can be explored and constrained withthis tool. This tool provides a handy wrapper for certain typesof capability testing and environment creation. It also provides somedebugging features useful for summarizing capability state.
The tool takes a number of optional arguments, acting on them in theorder they are provided. They are as follows:
- Display prevailing capability and related state.
- -- [args]
- Execute/bin/bashwith trailing arguments. Note, you can use-c 'command to execute'for specific commands.
- Executecapshagain with remaining arguments. Useful for testingexec()behavior.
- Set the prevailing process capabilities to those specified bycap-set.Wherecap-setis a text-representation of capability state as percap_from_text(3).
- Remove the listed capabilities from the prevailing bounding set. Thecapabilites are a comma separated list of capabilities as recognizedby thecap_from_name(3)function. Use of this feature requires that the capsh program isoperating withCAP_SETPCAPin its effective set.
- Set the inheritable set of capabilities for the current process toequal those provided in the comma separated list. For this action tosucceed, the prevailing process should already have each of thesecapabilities in the union of the current inheritable and permittedcapability sets, or the capsh program is operating withCAP_SETPCAPin its effective set.
- Assume the identity of the named user. That is, look up the user'suid and gidwithgetpwuid(3)and their group memberships withgetgrouplist(3)and set them all.
- Force alluidvalues to equalidusing thesetuid(2)system call.
- Force allgidvalues to equalidusing thesetgid(2)system call.
- Set the supplementary groups to the numerical list provided. Thegroups are set with thesetgroups(2)system call.
- In a non-pure capability mode, the kernel provides liberal privilegeto the super-user. However, it is normally the case that when thesuper-user changesuidto some lesser user, then capabilities are dropped. For thesesituations, the kernel can permit the process to retain itscapabilities after asetuid(2)system call. This feature is known askeep-capssupport. The way to activate it using this script is with thisargument. Setting the value to 1 will causekeep-capsto be active. Setting it to 0 will cause keep-caps to deactivate forthe current process. In all cases,keep-capsis deactivated when anexec()is performed. See--secbitsfor ways to disable this feature.
- XXX - need to document this feature.
- Execute thechroot(2)system call with the new root-directory (/) equal topath.This operation requiresCAP_SYS_CHROOTto be in effect.
- This is a convenience feature. If you look at/proc/1/statusthere are some capability related fields of the following form:
This option provides a quick way to decode a capability vectorrepresented in this form. For example, the missing capability fromthis effective set is 0x0100. By running:
we observe that the missing capability is:cap_setpcap.
- As the kernel evolves, more capabilities are added. This option can be usedto verify the existence of a capability on the system. For example,--supports=cap_syslogwill cause capsh to promptly exit with a status of 1 when run onkernel 2.6.27. However, when run on kernel 2.6.38 it will silentlysucceed.
EXIT STATUSFollowing successful execution the tool exits with status 0. Followingan error, the tool immediately exits with status 1.
AUTHORWritten by Andrew G. Morgan <morganAATTkernel.org>.
REPORTING BUGSPlease report bugs to the author.
- EXIT STATUS
- REPORTING BUGS
- SEE ALSO
This document was created byman2html,using the manual pages.