SEARCH
NEW RPMS
DIRECTORIES
ABOUT
FAQ
VARIOUS
BLOG
DONATE


YUM REPOSITORY

 
 

MAN page from CentOS 8 libcap-2.26-4.el8.x86_64.rpm

CAPSH

Section: User Commands (1)
Updated: 2011-04-24
Index 

NAME

capsh - capability shell wrapper 

SYNOPSIS

capsh[OPTION]... 

DESCRIPTION

Linux capability support and use can be explored and constrained withthis tool. This tool provides a handy wrapper for certain typesof capability testing and environment creation. It also provides somedebugging features useful for summarizing capability state. 

OPTIONS

The tool takes a number of optional arguments, acting on them in theorder they are provided. They are as follows:
--print
Display prevailing capability and related state.
-- [args]
Execute/bin/bashwith trailing arguments. Note, you can use-c 'command to execute'for specific commands.
==
Executecapshagain with remaining arguments. Useful for testingexec()behavior.
--caps=cap-set
Set the prevailing process capabilities to those specified bycap-set.Wherecap-setis a text-representation of capability state as percap_from_text(3).
--drop=cap-list
Remove the listed capabilities from the prevailing bounding set. Thecapabilites are a comma separated list of capabilities as recognizedby thecap_from_name(3)function. Use of this feature requires that the capsh program isoperating withCAP_SETPCAPin its effective set.
--inh=cap-list
Set the inheritable set of capabilities for the current process toequal those provided in the comma separated list. For this action tosucceed, the prevailing process should already have each of thesecapabilities in the union of the current inheritable and permittedcapability sets, or the capsh program is operating withCAP_SETPCAPin its effective set.
--user=username
Assume the identity of the named user. That is, look up the user'suid and gidwithgetpwuid(3)and their group memberships withgetgrouplist(3)and set them all.
--uid=id
Force alluidvalues to equalidusing thesetuid(2)system call.
--gid=<id>
Force allgidvalues to equalidusing thesetgid(2)system call.
--groups=<id-list>
Set the supplementary groups to the numerical list provided. Thegroups are set with thesetgroups(2)system call.
--keep=<0|1>
In a non-pure capability mode, the kernel provides liberal privilegeto the super-user. However, it is normally the case that when thesuper-user changesuidto some lesser user, then capabilities are dropped. For thesesituations, the kernel can permit the process to retain itscapabilities after asetuid(2)system call. This feature is known askeep-capssupport. The way to activate it using this script is with thisargument. Setting the value to 1 will causekeep-capsto be active. Setting it to 0 will cause keep-caps to deactivate forthe current process. In all cases,keep-capsis deactivated when anexec()is performed. See--secbitsfor ways to disable this feature.
--secbits=N
XXX - need to document this feature.
--chroot=path
Execute thechroot(2)system call with the new root-directory (/) equal topath.This operation requiresCAP_SYS_CHROOTto be in effect.
--forkfor=sec
--killit=sig
--decode=N
This is a convenience feature. If you look at/proc/1/statusthere are some capability related fields of the following form:


 CapInh:        0000000000000000

 CapPrm:        ffffffffffffffff

 CapEff:        fffffffffffffeff

 CapBnd:        ffffffffffffffff

This option provides a quick way to decode a capability vectorrepresented in this form. For example, the missing capability fromthis effective set is 0x0100. By running:


 capsh --decode=0x0100

we observe that the missing capability is:cap_setpcap.

--supports=xxx
As the kernel evolves, more capabilities are added. This option can be usedto verify the existence of a capability on the system. For example,--supports=cap_syslogwill cause capsh to promptly exit with a status of 1 when run onkernel 2.6.27. However, when run on kernel 2.6.38 it will silentlysucceed.
 

EXIT STATUS

Following successful execution the tool exits with status 0. Followingan error, the tool immediately exits with status 1. 

AUTHOR

Written by Andrew G. Morgan <morganAATTkernel.org>. 

REPORTING BUGS

Please report bugs to the author. 

SEE ALSO

libcap(3),getcap(8),setcap(8)andcapabilities(7).


 

Index

NAME
SYNOPSIS
DESCRIPTION
OPTIONS
EXIT STATUS
AUTHOR
REPORTING BUGS
SEE ALSO

This document was created byman2html,using the manual pages.