int vc_text2cap(char const *);
char const * vc_cap2text(unsigned int);
- inline static uint_least32_t vc_get_securecaps() {
+ inline static uint_least32_t vc_get_insecurecaps() {
return ( (1<<VC_CAP_LINUX_IMMUTABLE) | (1<<VC_CAP_NET_BROADCAST) |
(1<<VC_CAP_NET_ADMIN) | (1<<VC_CAP_NET_RAW) |
(1<<VC_CAP_IPC_LOCK) | (1<<VC_CAP_IPC_OWNER) |
setCap(optarg, &args.add_caps, &args.remove_caps);
break;
case CMD_SECURE :
- args.remove_caps |= vc_get_securecaps();
+ args.remove_caps |= vc_get_insecurecaps();
break;
case CMD_FLAG :
setFlags(optarg, &args.flags);
switch (c) {
case CMD_HELP : showHelp(1, argv[0], 0);
case CMD_VERSION : showVersion();
- case CMD_SECURE : remove = vc_get_securecaps(); break;
+ case CMD_SECURE : remove = vc_get_insecurecaps(); break;
case CMD_SHOW : do_show = true; break;
case CMD_PID : pid = atoi(optarg); break;
case CMD_CAP : remove = getCap(optarg); break;
caps.ccaps = ~0ull;
caps.cmask = ~0ull;
- caps.bcaps = ~vc_get_securecaps();
+ caps.bcaps = ~vc_get_insecurecaps();
caps.bmask = ~0ull;
Evc_set_ccaps(rc, &caps);
WRITE_MSG(fd,
" --set [--xid <xid>] [--bcap [~!]<cap>] [--ccap [~!]<cap>] [--flag [~!]<flag>] [--secure] -- [<program> <args>*]\n"
"\n"
- " --bcap <cap> ... system capability to be removed\n"
+ " --bcap <cap> ... system capability to be added\n"
" --cap <cap> ... context capability to be added\n"
"\n"
"Please report bugs to " PACKAGE_BUGREPORT "\n");
{
caps->ccaps = ~0ull;
caps->cmask = ~0ull;
- caps->bcaps = vc_get_securecaps();
+ caps->bcaps = ~vc_get_insecurecaps();
caps->bmask = ~0ull;
}
}
if (args.xid==VC_NOCTX) args.xid = Evc_get_task_xid(0);
- args.caps.bcaps = ~args.caps.bcaps;
if ((args.caps.cmask || args.caps.bmask) &&
vc_set_ccaps(args.xid, &args.caps)==-1)
}
if (vc_get_task_xid(0)!=1)
- Evc_new_s_context(1, vc_get_securecaps(), 0);
+ Evc_new_s_context(1, vc_get_insecurecaps(), 0);
Epipe(p);
pid = Efork();