1 #ifdef CAPSHDOC 2 #error "don't include this twice" 3 #endif 4 #define CAPSHDOC 5 6 /* 7 * A line by line explanation of each named capability value 8 */ 9 static const char *explanation0[] = { /* cap_chown = 0 */ 10 "Allows a process to arbitrarily change the user and", 11 "group ownership of a file.", 12 NULL 13 }; 14 static const char *explanation1[] = { /* cap_dac_override = 1 */ 15 "Allows a process to override of all Discretionary", 16 "Access Control (DAC) access, including ACL execute", 17 "access. That is read, write or execute files that the", 18 "process would otherwise not have access to. This", 19 "excludes DAC access covered by CAP_LINUX_IMMUTABLE.", 20 NULL 21 }; 22 static const char *explanation2[] = { /* cap_dac_read_search = 2 */ 23 "Allows a process to override all DAC restrictions", 24 "limiting the read and search of files and", 25 "directories. This excludes DAC access covered by", 26 "CAP_LINUX_IMMUTABLE.", 27 NULL 28 }; 29 static const char *explanation3[] = { /* cap_fowner = 3 */ 30 "Allows a process to perform operations on files, even", 31 "where file owner ID should otherwise need be equal to", 32 "the UID, except where CAP_FSETID is applicable. It", 33 "doesn't override MAC and DAC restrictions.", 34 NULL 35 }; 36 static const char *explanation4[] = { /* cap_fsetid = 4 */ 37 "Allows a process to set the S_ISUID and S_ISUID bits of", 38 "the file permissions, even when the process' effective", 39 "UID or GID/supplementary GIDs do not match that of the", 40 "file.", 41 NULL 42 }; 43 static const char *explanation5[] = { /* cap_kill = 5 */ 44 "Allows a process to send a kill(2) signal to any other", 45 "process - overriding the limitation that there be a", 46 "[E]UID match between source and target process.", 47 NULL 48 }; 49 static const char *explanation6[] = { /* cap_setgid = 6 */ 50 "Allows a process to freely manipulate its own GIDs:", 51 " - arbitrarily set the GID, EGID, REGID, RESGID values", 52 " - arbitrarily set the supplementary GIDs", 53 " - allows the forging of GID credentials passed over a", 54 " socket", 55 NULL 56 }; 57 static const char *explanation7[] = { /* cap_setuid = 7 */ 58 "Allows a process to freely manipulate its own UIDs:", 59 " - arbitrarily set the UID, EUID, REUID and RESUID", 60 " values", 61 " - allows the forging of UID credentials passed over a", 62 " socket", 63 NULL 64 }; 65 static const char *explanation8[] = { /* cap_setpcap = 8 */ 66 "Allows a process to freely manipulate its inheritable", 67 "capabilities. Linux supports the POSIX.1e Inheritable", 68 "set, as well as Bounding and Ambient Linux extension", 69 "vectors. This capability permits dropping bits from the", 70 "Bounding vector. It also permits the process to raise", 71 "Ambient vector bits that are both raised in the", 72 "Permitted and Inheritable sets of the process. This", 73 "capability cannot be used to raise Permitted bits, or", 74 "Effective bits beyond those already present in the", 75 "process' permitted set.", 76 "", 77 "[Historical note: prior to the advent of file", 78 "capabilities (2008), this capability was suppressed by", 79 "default, as its unsuppressed behavior was not", 80 "auditable: it could asynchronously grant its own", 81 "Permitted capabilities to and remove capabilities from", 82 "other processes arbitrarily. The former leads to", 83 "undefined behavior, and the latter is better served by", 84 "the kill system call.]", 85 NULL 86 }; 87 static const char *explanation9[] = { /* cap_linux_immutable = 9 */ 88 "Allows a process to modify the S_IMMUTABLE and", 89 "S_APPEND file attributes.", 90 NULL 91 }; 92 static const char *explanation10[] = { /* cap_net_bind_service = 10 */ 93 "Allows a process to bind to privileged ports:", 94 " - TCP/UDP sockets below 1024", 95 " - ATM VCIs below 32", 96 NULL 97 }; 98 static const char *explanation11[] = { /* cap_net_broadcast = 11 */ 99 "Allows a process to broadcast to the network and to", 100 "listen to multicast.", 101 NULL 102 }; 103 static const char *explanation12[] = { /* cap_net_admin = 12 */ 104 "Allows a process to perform network configuration", 105 "operations:", 106 " - interface configuration", 107 " - administration of IP firewall, masquerading and", 108 " accounting", 109 " - setting debug options on sockets", 110 " - modification of routing tables", 111 " - setting arbitrary process, and process group", 112 " ownership on sockets", 113 " - binding to any address for transparent proxying", 114 " (this is also allowed via CAP_NET_RAW)", 115 " - setting TOS (Type of service)", 116 " - setting promiscuous mode", 117 " - clearing driver statistics", 118 " - multicasing", 119 " - read/write of device-specific registers", 120 " - activation of ATM control sockets", 121 NULL 122 }; 123 static const char *explanation13[] = { /* cap_net_raw = 13 */ 124 "Allows a process to use raw networking:", 125 " - RAW sockets", 126 " - PACKET sockets", 127 " - binding to any address for transparent proxying", 128 " (also permitted via CAP_NET_ADMIN)", 129 NULL 130 }; 131 static const char *explanation14[] = { /* cap_ipc_lock = 14 */ 132 "Allows a process to lock shared memory segments for IPC", 133 "purposes. Also enables mlock and mlockall system", 134 "calls.", 135 NULL 136 }; 137 static const char *explanation15[] = { /* cap_ipc_owner = 15 */ 138 "Allows a process to override IPC ownership checks.", 139 NULL 140 }; 141 static const char *explanation16[] = { /* cap_sys_module = 16 */ 142 "Allows a process to initiate the loading and unloading", 143 "of kernel modules. This capability can effectively", 144 "modify kernel without limit.", 145 NULL 146 }; 147 static const char *explanation17[] = { /* cap_sys_rawio = 17 */ 148 "Allows a process to perform raw IO:", 149 " - permit ioper/iopl access", 150 " - permit sending USB messages to any device via", 151 " /dev/bus/usb", 152 NULL 153 }; 154 static const char *explanation18[] = { /* cap_sys_chroot = 18 */ 155 "Allows a process to perform a chroot syscall to change", 156 "the effective root of the process' file system:", 157 "redirect to directory \"/\" to some other location.", 158 NULL 159 }; 160 static const char *explanation19[] = { /* cap_sys_ptrace = 19 */ 161 "Allows a process to perform a ptrace() of any other", 162 "process.", 163 NULL 164 }; 165 static const char *explanation20[] = { /* cap_sys_pacct = 20 */ 166 "Allows a process to configure process accounting.", 167 NULL 168 }; 169 static const char *explanation21[] = { /* cap_sys_admin = 21 */ 170 "Allows a process to perform a somewhat arbitrary", 171 "grab-bag of privileged operations. Over time, this", 172 "capability should weaken as specific capabilities are", 173 "created for subsets of CAP_SYS_ADMINs functionality:", 174 " - configuration of the secure attention key", 175 " - administration of the random device", 176 " - examination and configuration of disk quotas", 177 " - setting the domainname", 178 " - setting the hostname", 179 " - calling bdflush()", 180 " - mount() and umount(), setting up new SMB connection", 181 " - some autofs root ioctls", 182 " - nfsservctl", 183 " - VM86_REQUEST_IRQ", 184 " - to read/write pci config on alpha", 185 " - irix_prctl on mips (setstacksize)", 186 " - flushing all cache on m68k (sys_cacheflush)", 187 " - removing semaphores", 188 " - Used instead of CAP_CHOWN to \"chown\" IPC message", 189 " queues, semaphores and shared memory", 190 " - locking/unlocking of shared memory segment", 191 " - turning swap on/off", 192 " - forged pids on socket credentials passing", 193 " - setting readahead and flushing buffers on block", 194 " devices", 195 " - setting geometry in floppy driver", 196 " - turning DMA on/off in xd driver", 197 " - administration of md devices (mostly the above, but", 198 " some extra ioctls)", 199 " - tuning the ide driver", 200 " - access to the nvram device", 201 " - administration of apm_bios, serial and bttv (TV)", 202 " device", 203 " - manufacturer commands in isdn CAPI support driver", 204 " - reading non-standardized portions of PCI", 205 " configuration space", 206 " - DDI debug ioctl on sbpcd driver", 207 " - setting up serial ports", 208 " - sending raw qic-117 commands", 209 " - enabling/disabling tagged queuing on SCSI", 210 " controllers and sending arbitrary SCSI commands", 211 " - setting encryption key on loopback filesystem", 212 " - setting zone reclaim policy", 213 NULL 214 }; 215 static const char *explanation22[] = { /* cap_sys_boot = 22 */ 216 "Allows a process to initiate a reboot of the system.", 217 NULL 218 }; 219 static const char *explanation23[] = { /* cap_sys_nice = 23 */ 220 "Allows a process to maipulate the execution priorities", 221 "of arbitrary processes:", 222 " - those involving different UIDs", 223 " - setting their CPU affinity", 224 " - alter the FIFO vs. round-robin (realtime)", 225 " scheduling for itself and other processes.", 226 NULL 227 }; 228 static const char *explanation24[] = { /* cap_sys_resource = 24 */ 229 "Allows a process to adjust resource related parameters", 230 "of processes and the system:", 231 " - set and override resource limits", 232 " - override quota limits", 233 " - override the reserved space on ext2 filesystem", 234 " (this can also be achieved via CAP_FSETID)", 235 " - modify the data journaling mode on ext3 filesystem,", 236 " which uses journaling resources", 237 " - override size restrictions on IPC message queues", 238 " - configure more than 64Hz interrupts from the", 239 " real-time clock", 240 " - override the maximum number of consoles for console", 241 " allocation", 242 " - override the maximum number of keymaps", 243 NULL 244 }; 245 static const char *explanation25[] = { /* cap_sys_time = 25 */ 246 "Allows a process to perform time manipulation of clocks:", 247 " - alter the system clock", 248 " - enable irix_stime on MIPS", 249 " - set the real-time clock", 250 NULL 251 }; 252 static const char *explanation26[] = { /* cap_sys_tty_config = 26 */ 253 "Allows a process to manipulate tty devices:", 254 " - configure tty devices", 255 " - perform vhangup() of a tty", 256 NULL 257 }; 258 static const char *explanation27[] = { /* cap_mknod = 27 */ 259 "Allows a process to perform privileged operations with", 260 "the mknod() system call.", 261 NULL 262 }; 263 static const char *explanation28[] = { /* cap_lease = 28 */ 264 "Allows a process to take leases on files.", 265 NULL 266 }; 267 static const char *explanation29[] = { /* cap_audit_write = 29 */ 268 "Allows a process to write to the audit log via a", 269 "unicast netlink socket.", 270 NULL 271 }; 272 static const char *explanation30[] = { /* cap_audit_control = 30 */ 273 "Allows a process to configure audit logging via a", 274 "unicast netlink socket.", 275 NULL 276 }; 277 static const char *explanation31[] = { /* cap_setfcap = 31 */ 278 "Allows a process to set capabilities on files.", 279 "Permits a process to uid_map the uid=0 of the", 280 "parent user namespace into that of the child", 281 "namespace. Also, permits a process to override", 282 "securebits locks through user namespace", 283 "creation.", 284 NULL 285 }; 286 static const char *explanation32[] = { /* cap_mac_override = 32 */ 287 "Allows a process to override Manditory Access Control", 288 "(MAC) access. Not all kernels are configured with a MAC", 289 "mechanism, but this is the capability reserved for", 290 "overriding them.", 291 NULL 292 }; 293 static const char *explanation33[] = { /* cap_mac_admin = 33 */ 294 "Allows a process to configure the Mandatory Access", 295 "Control (MAC) policy. Not all kernels are configured", 296 "with a MAC enabled, but if they are this capability is", 297 "reserved for code to perform administration tasks.", 298 NULL 299 }; 300 static const char *explanation34[] = { /* cap_syslog = 34 */ 301 "Allows a process to configure the kernel's syslog", 302 "(printk) behavior.", 303 NULL 304 }; 305 static const char *explanation35[] = { /* cap_wake_alarm = 35 */ 306 "Allows a process to trigger something that can wake the", 307 "system up.", 308 NULL 309 }; 310 static const char *explanation36[] = { /* cap_block_suspend = 36 */ 311 "Allows a process to block system suspends - prevent the", 312 "system from entering a lower power state.", 313 NULL 314 }; 315 static const char *explanation37[] = { /* cap_audit_read = 37 */ 316 "Allows a process to read the audit log via a multicast", 317 "netlink socket.", 318 NULL 319 }; 320 static const char *explanation38[] = { /* cap_perfmon = 38 */ 321 "Allows a process to enable observability of privileged", 322 "operations related to performance. The mechanisms", 323 "include perf_events, i915_perf and other kernel", 324 "subsystems.", 325 NULL 326 }; 327 static const char *explanation39[] = { /* cap_bpf = 39 */ 328 "Allows a process to manipulate aspects of the kernel", 329 "enhanced Berkeley Packet Filter (BPF) system. This is", 330 "an execution subsystem of the kernel, that manages BPF", 331 "programs. CAP_BPF permits a process to:", 332 " - create all types of BPF maps", 333 " - advanced verifier features:", 334 " - indirect variable access", 335 " - bounded loops", 336 " - BPF to BPF function calls", 337 " - scalar precision tracking", 338 " - larger complexity limits", 339 " - dead code elimination", 340 " - potentially other features", 341 "", 342 "Other capabilities can be used together with CAP_BFP to", 343 "further manipulate the BPF system:", 344 " - CAP_PERFMON relaxes the verifier checks as follows:", 345 " - BPF programs can use pointer-to-integer", 346 " conversions", 347 " - speculation attack hardening measures can be", 348 " bypassed", 349 " - bpf_probe_read to read arbitrary kernel memory is", 350 " permitted", 351 " - bpf_trace_printk to print the content of kernel", 352 " memory", 353 " - CAP_SYS_ADMIN permits the following:", 354 " - use of bpf_probe_write_user", 355 " - iteration over the system-wide loaded programs,", 356 " maps, links BTFs and convert their IDs to file", 357 " descriptors.", 358 " - CAP_PERFMON is required to load tracing programs.", 359 " - CAP_NET_ADMIN is required to load networking", 360 " programs.", 361 NULL 362 }; 363 static const char *explanation40[] = { /* cap_checkpoint_restore = 40 */ 364 "Allows a process to perform checkpoint", 365 "and restore operations. Also permits", 366 "explicit PID control via clone3() and", 367 "also writing to ns_last_pid.", 368 NULL 369 }; 370 static const char **explanations[] = { 371 explanation0, 372 explanation1, 373 explanation2, 374 explanation3, 375 explanation4, 376 explanation5, 377 explanation6, 378 explanation7, 379 explanation8, 380 explanation9, 381 explanation10, 382 explanation11, 383 explanation12, 384 explanation13, 385 explanation14, 386 explanation15, 387 explanation16, 388 explanation17, 389 explanation18, 390 explanation19, 391 explanation20, 392 explanation21, 393 explanation22, 394 explanation23, 395 explanation24, 396 explanation25, 397 explanation26, 398 explanation27, 399 explanation28, 400 explanation29, 401 explanation30, 402 explanation31, 403 explanation32, 404 explanation33, 405 explanation34, 406 explanation35, 407 explanation36, 408 explanation37, 409 explanation38, 410 explanation39, 411 explanation40, 412 }; 413 #define CAPSH_DOC_LIMIT 41 414