3 // Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
4 // based on reducecap.cc by Jacques Gelinas
6 // This program is free software; you can redistribute it and/or modify
7 // it under the terms of the GNU General Public License as published by
8 // the Free Software Foundation; either version 2, or (at your option)
11 // This program is distributed in the hope that it will be useful,
12 // but WITHOUT ANY WARRANTY; without even the implied warranty of
13 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 // GNU General Public License for more details.
16 // You should have received a copy of the GNU General Public License
17 // along with this program; if not, write to the Free Software
18 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
32 #include "linuxcaps.h"
35 # define CAP_QUOTACTL VC_CAP_QUOTACTL
38 extern int capget (struct __user_cap_header_struct *, struct __user_cap_data_struct *);
39 extern int capset (struct __user_cap_header_struct *, struct __user_cap_data_struct *);
43 fprintf (stderr,"reducecap version %s\n",VERSION);
44 fprintf (stderr,"reducecap [ options ] command argument\n");
48 static void reducecap_print(struct __user_cap_data_struct *user)
51 printf ("%22s %9s %9s %9s\n","Capability","Effective","Permitted"
54 char const * text = vc_cap2text(i);
58 printf ("%-22s %9s %9s %9s\n"
60 ,(user->effective & bit) ? "X " : " "
61 ,(user->permitted & bit) ? "X " : " "
62 ,(user->inheritable & bit) ? "X " : " ");
66 static void reducecap_show()
68 struct __user_cap_header_struct header;
69 struct __user_cap_data_struct user;
70 header.version = _LINUX_CAPABILITY_VERSION;
71 header.pid = getpid();
72 if (capget(&header,&user)==-1){
75 reducecap_print (&user);
81 int main (int argc, char *argv[])
84 unsigned long remove = 0;
87 unsigned long secure = (1<<CAP_LINUX_IMMUTABLE)
88 |(1<<CAP_NET_BROADCAST)
99 |(1<<CAP_SYS_RESOURCE)
104 for (i=1; i<argc; i++){
105 const char *arg = argv[i];
106 const char *opt = argv[i+1];
107 if (strcmp(arg,"--secure")==0){
109 }else if (strcmp(arg,"--show")==0){
111 }else if (strcmp(arg,"--flag")==0){
112 if (strcmp(opt,"lock")==0){
114 }else if (strcmp(opt,"sched")==0){
116 }else if (strcmp(opt,"nproc")==0){
118 }else if (strcmp(opt,"private")==0){
120 }else if (strcmp(opt,"hideinfo")==0){
123 fprintf (stderr,"Unknown flag %s\n",opt);
126 }else if (arg[0] == '-' && arg[1] == '-'){
131 // The following capabilities are normally available
132 // to vservers administrator, but are place for
134 {"CAP_CHOWN",CAP_CHOWN},
135 {"CAP_DAC_OVERRIDE",CAP_DAC_OVERRIDE},
136 {"CAP_DAC_READ_SEARCH",CAP_DAC_READ_SEARCH},
137 {"CAP_FOWNER",CAP_FOWNER},
138 {"CAP_FSETID",CAP_FSETID},
139 {"CAP_KILL",CAP_KILL},
140 {"CAP_SETGID",CAP_SETGID},
141 {"CAP_SETUID",CAP_SETUID},
142 {"CAP_SETPCAP",CAP_SETPCAP},
143 {"CAP_SYS_TTY_CONFIG",CAP_SYS_TTY_CONFIG},
144 {"CAP_LEASE",CAP_LEASE},
145 {"CAP_SYS_CHROOT",CAP_SYS_CHROOT},
147 // Those capabilities are not normally available
148 // to vservers because they are not needed and
149 // may represent a security risk
150 {"--LINUX_IMMUTABLE",CAP_LINUX_IMMUTABLE},
151 {"--NET_BIND_SERVICE",CAP_NET_BIND_SERVICE},
152 {"--NET_BROADCAST",CAP_NET_BROADCAST},
153 {"--NET_ADMIN", CAP_NET_ADMIN},
154 {"--NET_RAW", CAP_NET_RAW},
155 {"--IPC_LOCK", CAP_IPC_LOCK},
156 {"--IPC_OWNER", CAP_IPC_OWNER},
157 {"--SYS_MODULE",CAP_SYS_MODULE},
158 {"--SYS_RAWIO", CAP_SYS_RAWIO},
159 {"--SYS_PACCT", CAP_SYS_PACCT},
160 {"--SYS_ADMIN", CAP_SYS_ADMIN},
161 {"--SYS_BOOT", CAP_SYS_BOOT},
162 {"--SYS_NICE", CAP_SYS_NICE},
163 {"--SYS_RESOURCE",CAP_SYS_RESOURCE},
164 {"--SYS_TIME", CAP_SYS_TIME},
165 {"--MKNOD", CAP_MKNOD},
166 {"--QUOTACTL", CAP_QUOTACTL},
170 for (j=0; tbcap[j].option != NULL; j++){
171 if (strcasecmp(tbcap[j].option,arg)==0){
172 remove |= (1<<tbcap[j].bit);
176 if (tbcap[j].option != NULL){
189 }else if (argv[i][0] == '-'){
192 struct __user_cap_header_struct header;
193 struct __user_cap_data_struct user;
194 header.version = _LINUX_CAPABILITY_VERSION;
196 if (capget(&header,&user)==-1){
200 reducecap_print (&user);
202 if (vc_new_s_context(VC_SAMECTX,remove,flags)==VC_NOCTX){
203 perror ("new_s_context -2");
205 fprintf (stderr,"Executing\n");
206 execvp (argv[i],argv+i);
207 fprintf (stderr,"Can't execute command %s\n",argv[i]);