#define VC_CAP_LEASE 28
#define VC_CAP_AUDIT_WRITE 29
#define VC_CAP_AUDIT_CONTROL 30
+#define VC_CAP_SETFCAP 31
+#define VC_CAP_MAC_OVERRIDE 32
+#define VC_CAP_MAC_ADMIN 33
#define VC_IMMUTABLE_FILE_FL 0x0000010lu
#define VC_IMMUTABLE_LINK_FL 0x0008000lu
#define VC_IATTR_BARRIER 0x00010000u
#define VC_IATTR_IUNLINK 0x00020000u
#define VC_IATTR_IMMUTABLE 0x00040000u
+#define VC_IATTR_COW 0x00080000u
// the flags
// the ccapabilities
#define VC_VXC_SET_UTSNAME 0x00000001ull
#define VC_VXC_SET_RLIMIT 0x00000002ull
+#define VC_VXC_FS_SECURITY 0x00000004ull
+#define VC_VXC_TIOCSTI 0x00000010ull
#define VC_VXC_RAW_ICMP 0x00000100ull
#define VC_VXC_SYSLOG 0x00001000ull
+#define VC_VXC_OOM_ADJUST 0x00002000ull
+#define VC_VXC_AUDIT_CONTROL 0x00004000ull
#define VC_VXC_SECURE_MOUNT 0x00010000ull
#define VC_VXC_SECURE_REMOUNT 0x00020000ull
#define VC_VXC_ADMIN_CLOOP 0x00400000ull
#define VC_VXC_KTHREAD 0x01000000ull
+#define VC_VXC_NAMESPACE 0x02000000ull
// the scheduler flags
// the VCI bit values
#define VC_VCI_NO_DYNAMIC (1 << 0)
+#define VC_VCI_PROC_SECURE (1 << 4)
+#define VC_VCI_HARDCPU (1 << 5)
+#define VC_VCI_IDLELIMIT (1 << 6)
+#define VC_VCI_IDLETIME (1 << 7)
+#define VC_VCI_COWBL (1 << 8)
+#define VC_VCI_FULLCOWBL (1 << 9)
#define VC_VCI_SPACES (1 << 10)
#define VC_VCI_NETV2 (1 << 11)
+#define VC_VCI_MEMCG (1 << 12)
+#define VC_VCI_DEBUG (1 << 16)
+#define VC_VCI_HISTORY (1 << 20)
+#define VC_VCI_TAGGED (1 << 24)
#define VC_VCI_PPTAG (1 << 28)
char *val, size_t len) VC_ATTR_NONNULL((3));
/* namespace related functions */
- int vc_enter_namespace(xid_t xid, uint_least64_t mask);
- int vc_set_namespace(xid_t xid, uint_least64_t mask);
- int vc_cleanup_namespace();
- uint_least64_t vc_get_space_mask();
+ int vc_enter_namespace(xid_t xid, uint_least64_t mask, uint32_t index);
+ int vc_set_namespace(xid_t xid, uint_least64_t mask, uint32_t index);
+ int vc_cleanup_namespace(void);
+ uint_least64_t vc_get_space_mask(void);
+ uint_least64_t vc_get_space_default(void);
/* disk limit related things */
uint_least64_t vc_get_insecurebcaps() VC_ATTR_CONST;
inline static uint_least64_t vc_get_insecureccaps() {
- return ~(VC_VXC_SET_UTSNAME|VC_VXC_RAW_ICMP);
+ return ~(VC_VXC_SET_UTSNAME|VC_VXC_RAW_ICMP|VC_VXC_AUDIT_CONTROL);
}
inline static int vc_setfilecontext(char const *filename, xid_t xid) {
vcFEATURE_COMPAT, vcFEATURE_MIGRATE, vcFEATURE_NAMESPACE,
vcFEATURE_SCHED, vcFEATURE_VINFO, vcFEATURE_VHI,
vcFEATURE_VSHELPER0, vcFEATURE_VSHELPER, vcFEATURE_VWAIT,
- vcFEATURE_VNET, vcFEATURE_VSTAT, vcFEATURE_PPTAG,
- vcFEATURE_PIDSPACE, }
+ vcFEATURE_VNET, vcFEATURE_VSTAT, vcFEATURE_PPTAG,
+ vcFEATURE_PIDSPACE, vcFEATURE_SPACES, vcFEATURE_PERSISTENT,
+ vcFEATURE_PIVOT_ROOT, vcFEATURE_MEMCG,
+ }
vcFeatureSet;
bool vc_isSupported(vcFeatureSet) VC_ATTR_CONST;