diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/Makefile.am | 34 | ||||
| -rw-r--r-- | docs/Makefile.in | 476 | ||||
| -rw-r--r-- | docs/capng_apply.3 | 28 | ||||
| -rw-r--r-- | docs/capng_capability_to_name.3 | 23 | ||||
| -rw-r--r-- | docs/capng_change_id.3 | 41 | ||||
| -rw-r--r-- | docs/capng_clear.3 | 22 | ||||
| -rw-r--r-- | docs/capng_fill.3 | 22 | ||||
| -rw-r--r-- | docs/capng_get_caps_fd.3 | 23 | ||||
| -rw-r--r-- | docs/capng_get_caps_process.3 | 27 | ||||
| -rw-r--r-- | docs/capng_have_capabilities.3 | 25 | ||||
| -rw-r--r-- | docs/capng_have_capability.3 | 25 | ||||
| -rw-r--r-- | docs/capng_lock.3 | 25 | ||||
| -rw-r--r-- | docs/capng_name_to_capability.3 | 23 | ||||
| -rw-r--r-- | docs/capng_print_caps_numeric.3 | 24 | ||||
| -rw-r--r-- | docs/capng_print_caps_text.3 | 24 | ||||
| -rw-r--r-- | docs/capng_restore_state.3 | 23 | ||||
| -rw-r--r-- | docs/capng_save_state.3 | 23 | ||||
| -rw-r--r-- | docs/capng_set_caps_fd.3 | 24 | ||||
| -rw-r--r-- | docs/capng_setpid.3 | 23 | ||||
| -rw-r--r-- | docs/capng_update.3 | 23 | ||||
| -rw-r--r-- | docs/capng_updatev.3 | 26 |
21 files changed, 984 insertions, 0 deletions
diff --git a/docs/Makefile.am b/docs/Makefile.am new file mode 100644 index 0000000..7e498e1 --- /dev/null +++ b/docs/Makefile.am @@ -0,0 +1,34 @@ +# Makefile.am -- +# Copyright 2009 Red Hat Inc., Durham, North Carolina. +# All Rights Reserved. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +# Authors: +# Steve Grubb <sgrubb@redhat.com> +# + +CONFIG_CLEAN_FILES = *.rej *.orig + +EXTRA_DIST = $(man_MANS) + +man_MANS = capng_clear.3 capng_fill.3 capng_setpid.3 \ + capng_get_caps_process.3 capng_update.3 capng_updatev.3 \ + capng_apply.3 capng_lock.3 capng_change_id.3 capng_get_caps_fd.3 \ + capng_set_caps_fd.3 capng_have_capabilities.3 capng_have_capability.3 \ + capng_print_caps_numeric.3 capng_print_caps_text.3 \ + capng_name_to_capability.3 capng_capability_to_name.3 \ + capng_save_state.3 capng_restore_state.3 + diff --git a/docs/Makefile.in b/docs/Makefile.in new file mode 100644 index 0000000..67efcbf --- /dev/null +++ b/docs/Makefile.in @@ -0,0 +1,476 @@ +# Makefile.in generated by automake 1.11.1 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, +# Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + +# Makefile.am -- +# Copyright 2009 Red Hat Inc., Durham, North Carolina. +# All Rights Reserved. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +# Authors: +# Steve Grubb <sgrubb@redhat.com> +# +VPATH = @srcdir@ +pkgdatadir = $(datadir)/@PACKAGE@ +pkgincludedir = $(includedir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkglibexecdir = $(libexecdir)/@PACKAGE@ +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +target_triplet = @target@ +subdir = docs +DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/configure.ac +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_VPATH_FILES = +SOURCES = +DIST_SOURCES = +am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; +am__vpath_adj = case $$p in \ + $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ + *) f=$$p;; \ + esac; +am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; +am__install_max = 40 +am__nobase_strip_setup = \ + srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` +am__nobase_strip = \ + for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" +am__nobase_list = $(am__nobase_strip_setup); \ + for p in $$list; do echo "$$p $$p"; done | \ + sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ + $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ + if (++n[$$2] == $(am__install_max)) \ + { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ + END { for (dir in files) print dir, files[dir] }' +am__base_list = \ + sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ + sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' +man3dir = $(mandir)/man3 +am__installdirs = "$(DESTDIR)$(man3dir)" +NROFF = nroff +MANS = $(man_MANS) +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +ACLOCAL = @ACLOCAL@ +AMTAR = @AMTAR@ +AR = @AR@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEBUG = @DEBUG@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +DSYMUTIL = @DSYMUTIL@ +DUMPBIN = @DUMPBIN@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EXEEXT = @EXEEXT@ +FGREP = @FGREP@ +GREP = @GREP@ +INSTALL = @INSTALL@ +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LD = @LD@ +LDFLAGS = @LDFLAGS@ +LIBOBJS = @LIBOBJS@ +LIBS = @LIBS@ +LIBTOOL = @LIBTOOL@ +LIBTOOL_DEPS = @LIBTOOL_DEPS@ +LIPO = @LIPO@ +LN_S = @LN_S@ +LTLIBOBJS = @LTLIBOBJS@ +MAKEINFO = @MAKEINFO@ +MKDIR_P = @MKDIR_P@ +NM = @NM@ +NMEDIT = @NMEDIT@ +OBJDUMP = @OBJDUMP@ +OBJEXT = @OBJEXT@ +OTOOL = @OTOOL@ +OTOOL64 = @OTOOL64@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_URL = @PACKAGE_URL@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +PYTHON = @PYTHON@ +PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ +PYTHON_PLATFORM = @PYTHON_PLATFORM@ +PYTHON_PREFIX = @PYTHON_PREFIX@ +PYTHON_VERSION = @PYTHON_VERSION@ +RANLIB = @RANLIB@ +SED = @SED@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +STRIP = @STRIP@ +VERSION = @VERSION@ +abs_builddir = @abs_builddir@ +abs_srcdir = @abs_srcdir@ +abs_top_builddir = @abs_top_builddir@ +abs_top_srcdir = @abs_top_srcdir@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +builddir = @builddir@ +datadir = @datadir@ +datarootdir = @datarootdir@ +docdir = @docdir@ +dvidir = @dvidir@ +exec_prefix = @exec_prefix@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +htmldir = @htmldir@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +libdir = @libdir@ +libexecdir = @libexecdir@ +localedir = @localedir@ +localstatedir = @localstatedir@ +mandir = @mandir@ +mkdir_p = @mkdir_p@ +oldincludedir = @oldincludedir@ +pdfdir = @pdfdir@ +pkgpyexecdir = @pkgpyexecdir@ +pkgpythondir = @pkgpythondir@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +psdir = @psdir@ +pyexecdir = @pyexecdir@ +pythondir = @pythondir@ +sbindir = @sbindir@ +sharedstatedir = @sharedstatedir@ +srcdir = @srcdir@ +swig_found = @swig_found@ +sysconfdir = @sysconfdir@ +target = @target@ +target_alias = @target_alias@ +target_cpu = @target_cpu@ +target_os = @target_os@ +target_vendor = @target_vendor@ +top_build_prefix = @top_build_prefix@ +top_builddir = @top_builddir@ +top_srcdir = @top_srcdir@ +CONFIG_CLEAN_FILES = *.rej *.orig +EXTRA_DIST = $(man_MANS) +man_MANS = capng_clear.3 capng_fill.3 capng_setpid.3 \ + capng_get_caps_process.3 capng_update.3 capng_updatev.3 \ + capng_apply.3 capng_lock.3 capng_change_id.3 capng_get_caps_fd.3 \ + capng_set_caps_fd.3 capng_have_capabilities.3 capng_have_capability.3 \ + capng_print_caps_numeric.3 capng_print_caps_text.3 \ + capng_name_to_capability.3 capng_capability_to_name.3 \ + capng_save_state.3 capng_restore_state.3 + +all: all-am + +.SUFFIXES: +$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ + && { if test -f $@; then exit 0; else break; fi; }; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu docs/Makefile'; \ + $(am__cd) $(top_srcdir) && \ + $(AUTOMAKE) --gnu docs/Makefile +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(am__aclocal_m4_deps): + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs +install-man3: $(man_MANS) + @$(NORMAL_INSTALL) + test -z "$(man3dir)" || $(MKDIR_P) "$(DESTDIR)$(man3dir)" + @list=''; test -n "$(man3dir)" || exit 0; \ + { for i in $$list; do echo "$$i"; done; \ + l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \ + sed -n '/\.3[a-z]*$$/p'; \ + } | while read p; do \ + if test -f $$p; then d=; else d="$(srcdir)/"; fi; \ + echo "$$d$$p"; echo "$$p"; \ + done | \ + sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^3][0-9a-z]*$$,3,;x' \ + -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \ + sed 'N;N;s,\n, ,g' | { \ + list=; while read file base inst; do \ + if test "$$base" = "$$inst"; then list="$$list $$file"; else \ + echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man3dir)/$$inst'"; \ + $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man3dir)/$$inst" || exit $$?; \ + fi; \ + done; \ + for i in $$list; do echo "$$i"; done | $(am__base_list) | \ + while read files; do \ + test -z "$$files" || { \ + echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man3dir)'"; \ + $(INSTALL_DATA) $$files "$(DESTDIR)$(man3dir)" || exit $$?; }; \ + done; } + +uninstall-man3: + @$(NORMAL_UNINSTALL) + @list=''; test -n "$(man3dir)" || exit 0; \ + files=`{ for i in $$list; do echo "$$i"; done; \ + l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \ + sed -n '/\.3[a-z]*$$/p'; \ + } | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^3][0-9a-z]*$$,3,;x' \ + -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \ + test -z "$$files" || { \ + echo " ( cd '$(DESTDIR)$(man3dir)' && rm -f" $$files ")"; \ + cd "$(DESTDIR)$(man3dir)" && rm -f $$files; } +tags: TAGS +TAGS: + +ctags: CTAGS +CTAGS: + + +distdir: $(DISTFILES) + @list='$(MANS)'; if test -n "$$list"; then \ + list=`for p in $$list; do \ + if test -f $$p; then d=; else d="$(srcdir)/"; fi; \ + if test -f "$$d$$p"; then echo "$$d$$p"; else :; fi; done`; \ + if test -n "$$list" && \ + grep 'ab help2man is required to generate this page' $$list >/dev/null; then \ + echo "error: found man pages containing the \`missing help2man' replacement text:" >&2; \ + grep -l 'ab help2man is required to generate this page' $$list | sed 's/^/ /' >&2; \ + echo " to fix them, install help2man, remove and regenerate the man pages;" >&2; \ + echo " typically \`make maintainer-clean' will remove them" >&2; \ + exit 1; \ + else :; fi; \ + else :; fi + @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + list='$(DISTFILES)'; \ + dist_files=`for file in $$list; do echo $$file; done | \ + sed -e "s|^$$srcdirstrip/||;t" \ + -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ + case $$dist_files in \ + */*) $(MKDIR_P) `echo "$$dist_files" | \ + sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ + sort -u` ;; \ + esac; \ + for file in $$dist_files; do \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + if test -d $$d/$$file; then \ + dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test -d "$(distdir)/$$file"; then \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ + else \ + test -f "$(distdir)/$$file" \ + || cp -p $$d/$$file "$(distdir)/$$file" \ + || exit 1; \ + fi; \ + done +check-am: all-am +check: check-am +all-am: Makefile $(MANS) +installdirs: + for dir in "$(DESTDIR)$(man3dir)"; do \ + test -z "$$dir" || $(MKDIR_P) "$$dir"; \ + done +install: install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am +install-strip: + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + `test -z '$(STRIP)' || \ + echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install +mostlyclean-generic: + +clean-generic: + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." +clean: clean-am + +clean-am: clean-generic clean-libtool mostlyclean-am + +distclean: distclean-am + -rm -f Makefile +distclean-am: clean-am distclean-generic + +dvi: dvi-am + +dvi-am: + +html: html-am + +html-am: + +info: info-am + +info-am: + +install-data-am: install-man + +install-dvi: install-dvi-am + +install-dvi-am: + +install-exec-am: + +install-html: install-html-am + +install-html-am: + +install-info: install-info-am + +install-info-am: + +install-man: install-man3 + +install-pdf: install-pdf-am + +install-pdf-am: + +install-ps: install-ps-am + +install-ps-am: + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -f Makefile +maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-generic mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: uninstall-man + +uninstall-man: uninstall-man3 + +.MAKE: install-am install-strip + +.PHONY: all all-am check check-am clean clean-generic clean-libtool \ + distclean distclean-generic distclean-libtool distdir dvi \ + dvi-am html html-am info info-am install install-am \ + install-data install-data-am install-dvi install-dvi-am \ + install-exec install-exec-am install-html install-html-am \ + install-info install-info-am install-man install-man3 \ + install-pdf install-pdf-am install-ps install-ps-am \ + install-strip installcheck installcheck-am installdirs \ + maintainer-clean maintainer-clean-generic mostlyclean \ + mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ + uninstall uninstall-am uninstall-man uninstall-man3 + + +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# Otherwise a system limit (for SysV at least) may be exceeded. +.NOEXPORT: diff --git a/docs/capng_apply.3 b/docs/capng_apply.3 new file mode 100644 index 0000000..ba01229 --- /dev/null +++ b/docs/capng_apply.3 @@ -0,0 +1,28 @@ +.TH "CAPNG_APPLY" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_apply \- apply the stored capabilities settings +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_apply(capng_select_t set); + +.SH "DESCRIPTION" + +capng_apply will transfer the specified internal posix capabilities settings to the kernel. The options are CAPNG_SELECT_CAPS for the traditional capabilities, CAPNG_SELECT_BOUNDS for the bounding set, or CAPNG_SELECT_BOTH if transferring both is desired. + +.SH "RETURN VALUE" + +This returns 0 on success and -1 on failure. + +.SH NOTES + +If you are doing multi-threaded programming, calling this function will only set capabilities on the calling thread. All other threads are unaffected. If you want to set overall capabilities for a multi-threaded process, you will need to do that before creating any threads. See the capset syscall for more information on this topic. + +.SH "SEE ALSO" + +.BR capset (2), +.BR capng_update (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_capability_to_name.3 b/docs/capng_capability_to_name.3 new file mode 100644 index 0000000..30aea0c --- /dev/null +++ b/docs/capng_capability_to_name.3 @@ -0,0 +1,23 @@ +.TH "CAPNG_CAPABILITY_TO_NAME" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_capability_to_name \- convert capability integer to text +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +const char *capng_capability_to_name(unsigned int capability); + +.SH "DESCRIPTION" + +capng_capabilityi_to_name will take the integer being passed and look it up to see what its text string representation would be. The integer being input must be in the valid range defined in linux/capabiliy.h. The string that is output is the same as the define text from linux/capabiliy.h with the CAP_ prefix removed and lower case. This is useful for taking integer representation and converting it to something more user friendly for display. + +.SH "RETURN VALUE" + +This returns a NULL pointer on failure and the correct string otherwise. + +.SH "SEE ALSO" + +.BR capng_name_to_capability (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_change_id.3 b/docs/capng_change_id.3 new file mode 100644 index 0000000..3abfdd8 --- /dev/null +++ b/docs/capng_change_id.3 @@ -0,0 +1,41 @@ +.TH "CAPNG_CHANGE_ID" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_change_id \- change the credentials retaining capabilities +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_change_id(int uid, int gid, capng_flags_t flag); + +.SH "DESCRIPTION" + +This function will change uid and gid to the ones given while retaining the capabilities previously specified in capng_update. It is not necessary and perhaps better if capng_apply has not been called prior to this function so that all necessary privileges are still intact. The caller is required to have CAP_SETPCAP capability still active before calling this function. + +This function also takes a flag parameter that helps to tailor the exact actions performed by the function to secure the environment. The option may be or'ed together. The legal values are: + +.RS +.TP +.B CAPNG_NO_FLAG +Simply change uid and retain specified capabilities and that's all. +.TP +.B CAPNG_DROP_SUPP_GRP +After changing id, remove and supplement groups that may come with the account. +.TP +.B CAPNG_CLEAR_BOUNDING +After changing the uid and gid, clear the bounding set regardless to the internal representation already setup. + +.RE +.SH "RETURN VALUE" + +This returns 0 on success and a negative number on failure. -1 means capng has not been initted properly, -2 means a failure requesting to keep capabilities across the uid change, -3 means that applying the intermediate capabilities failed, -4 means changing gid failed, -5 means dropping supplemental groups failed, -6 means changing the uid failed, -7 means dropping the ability to retain caps across a uid change failed, -8 means clearing the bounding set failed, -9 means dropping CAP_SETPCAP failed. + +Note: the only safe action to do upon failure of this function is to probably exit. This is because you are likely in a situation with partial permissions and not what you intended. + +.SH "SEE ALSO" + +.BR capng_update (3), +.BR capng_apply (3), +.BR prctl (2), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_clear.3 b/docs/capng_clear.3 new file mode 100644 index 0000000..7661c60 --- /dev/null +++ b/docs/capng_clear.3 @@ -0,0 +1,22 @@ +.TH "CAPNG_CLEAR" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_clear \- clear chosen capabilities set +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +void capng_clear(capng_select_t set); + +.SH "DESCRIPTION" + +capng_clear sets to 0 all bits in the selected posix capabilities set. The options are CAPNG_SELECT_CAPS for the traditional capabilities, CAPNG_SELECT_BOUNDS for the bounding set, or CAPNG_SELECT_BOTH if clearing both is desired. + +.SH "RETURN VALUE" + +None. + +.SH "SEE ALSO" + +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_fill.3 b/docs/capng_fill.3 new file mode 100644 index 0000000..802a6e7 --- /dev/null +++ b/docs/capng_fill.3 @@ -0,0 +1,22 @@ +.TH "CAPNG_FILL" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_fill \- fill chosen capabilities set +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +void capng_fill(capng_select_t set); + +.SH "DESCRIPTION" + +capng_fill sets all bits to a 1 in the selected posix capabilities set. The options are CAPNG_SELECT_CAPS for the traditional capabilities, CAPNG_SELECT_BOUNDS for the bounding set, or CAPNG_SELECT_BOTH if filling both is desired. + +.SH "RETURN VALUE" + +None. + +.SH "SEE ALSO" + +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_get_caps_fd.3 b/docs/capng_get_caps_fd.3 new file mode 100644 index 0000000..80f3464 --- /dev/null +++ b/docs/capng_get_caps_fd.3 @@ -0,0 +1,23 @@ +.TH "CAPNG_GET_CAPS_FD" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_get_caps_fd \- +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_get_caps_fd(int fd); + +.SH "DESCRIPTION" + +This function will read the file based capabilities stored in extended attributes of the file that the descriptor was opened against. The bounding set is not included in file based capabilities operations. Note that this function will only work if compiled on a kernel that supports file based capabilities such as 2.6.26 and later. If the "magic" bit is set, then all effect capability bits are set. Otherwise the bits are cleared. + +.SH "RETURN VALUE" + +This returns 0 on success and -1 on failure. + +.SH "SEE ALSO" + +.BR capng_set_caps_fd (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_get_caps_process.3 b/docs/capng_get_caps_process.3 new file mode 100644 index 0000000..87175ae --- /dev/null +++ b/docs/capng_get_caps_process.3 @@ -0,0 +1,27 @@ +.TH "CAPNG_GET_CAPS_PROCESS" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_get_caps_process \- get the capabilities from a process +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_get_caps_process(void); + +.SH "DESCRIPTION" + +capng_get_caps_process will get the capabilities and bounding set of the pid stored inside libcap-ng's state table. The default is the pid of the running process. This can be changed by using the capng_setpid function. + +.SH "RETURN VALUE" + +This returns 0 on success and -1 on failure. + +.SH NOTES + +If you are doing multi-threaded programming, calling this function will only get capabilities on the calling thread. If you want to get overall capabilities for a multi-threaded process, you can only do that before creating any threads. Afterwards, threads may be able to independantly set capabilities. + +.SH "SEE ALSO" + +.BR capng_setpid (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_have_capabilities.3 b/docs/capng_have_capabilities.3 new file mode 100644 index 0000000..fac6a42 --- /dev/null +++ b/docs/capng_have_capabilities.3 @@ -0,0 +1,25 @@ +.TH "CAPNG_HAVE_CAPABILITIES" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_have_capabilities \- general check for capabilities +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +capng_results_t capng_have_capabilities(capng_select_t set); + +.SH "DESCRIPTION" + +capng_have_capabilities will check the selected internal capabilities sets to see what the status is. The capabilities sets must be previously setup with calls to capng_get_caps_process, capng_get_caps_fd, or in some other way setup. The options are CAPNG_SELECT_CAPS for the traditional capabilities, CAPNG_SELECT_BOUNDS for the bounding set, or CAPNG_SELECT_BOTH if clearing both is desired. + +.SH "RETURN VALUE" + +This funtion will return one of the following four self explanatory values: CAPNG_FAIL, CAPNG_NONE, CAPNG_PARTIAL, CAPNG_FULL. + +.SH "SEE ALSO" + +.BR capng_get_caps_process (3), +.BR capng_get_caps_fd (3), +.BR capng_have_capability (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_have_capability.3 b/docs/capng_have_capability.3 new file mode 100644 index 0000000..54e1abf --- /dev/null +++ b/docs/capng_have_capability.3 @@ -0,0 +1,25 @@ +.TH "CAPNG_HAVE_CAPABILITY" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_have_capability \- check for specific capability +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_have_capability(capng_type_t which, unsigned int capability); + +.SH "DESCRIPTION" + +capng_have_capability will check the specified internal capabilities set to see if the specified capability is set. The capabilities sets must be previously setup with calls to capng_get_caps_process, capng_get_caps_fd, or in some other way setup. The values for which should be one of: CAPNG_EFFECTIVE, CAPNG_PERMITTED, CAPNG_INHERITABLE, or CAPNG_BOUNDING_SET. + +.SH "RETURN VALUE" + +This funtion will return 1 if yes and 0 otherwise. + +.SH "SEE ALSO" + +.BR capng_get_caps_process (3), +.BR capng_get_caps_fd (3), +.BR capng_have_capabilities (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_lock.3 b/docs/capng_lock.3 new file mode 100644 index 0000000..7683119 --- /dev/null +++ b/docs/capng_lock.3 @@ -0,0 +1,25 @@ +.TH "CAPNG_LOCK" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_lock \- lock the current process capabilities settings +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_lock(void); + +.SH "DESCRIPTION" + +capng_lock will take steps to prevent children of the current process to regain full privileges if the uid is 0. This should be called while possessing the CAP_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel: Set the NOROOT option on for PR_SET_SECUREBITS, set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS, set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS, and set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS. + + +.SH "RETURN VALUE" + +This returns 0 on success and a negative number on failure. -1 means a failure setting any of the PR_SET_SECUREBITS options. + +.SH "SEE ALSO" + +.BR capng_apply (3), +.BR prctl (2), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_name_to_capability.3 b/docs/capng_name_to_capability.3 new file mode 100644 index 0000000..36950a0 --- /dev/null +++ b/docs/capng_name_to_capability.3 @@ -0,0 +1,23 @@ +.TH "CAPNG_NAME_TO_CAPABILITY" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_name_to_capability \- convert capability text to integer +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_name_to_capability(const char *name); + +.SH "DESCRIPTION" + +capng_name_to_capability will take the string being passed and look it up to see what its integer value would be. The string being input is the same name as the define in linux/capabiliy.h with the CAP_ prefix removed. The string case does not matter. The integer that is output is the same as the define would be from linux/capabiliy.h. This is useful for taking string input and converting to something that can be used with capng_update. + +.SH "RETURN VALUE" + +This returns a negative number on failure and the correct define otherwise. + +.SH "SEE ALSO" + +.BR capng_capability_to_name (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_print_caps_numeric.3 b/docs/capng_print_caps_numeric.3 new file mode 100644 index 0000000..fc5fb52 --- /dev/null +++ b/docs/capng_print_caps_numeric.3 @@ -0,0 +1,24 @@ +.TH "CAPNG_PRINT_CAPS_NUMERIC" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_print_caps_numeric \- print numeric values for capabilities set +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +char *capng_print_caps_numeric(capng_print_t where, capng_select_t set); + +.SH "DESCRIPTION" + +capng_print_caps_numeric will create a numeric representation of the internal capabilities. The representation can be sent to either stdout or a buffer by passing CAPNG_PRINT_STDOUT or CAPNG_PRINT_BUFFER respectively for the where parameter. If the option was for a buffer, this function will malloc a buffer that the caller must free. + +The set parameter controls what is included in the representation. The legal options are CAPNG_SELECT_CAPS for the traditional capabilities, CAPNG_SELECT_BOUNDS for the bounding set, or CAPNG_SELECT_BOTH if clearing both is desired. + +.SH "RETURN VALUE" + +If CAPNG_PRINT_BUFFER was selected for where, this will be the text buffer and NULL on failure. If CAPNG_PRINT_STDOUT was selected then this value will be NULL no matter what. + +.SH "SEE ALSO" + +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_print_caps_text.3 b/docs/capng_print_caps_text.3 new file mode 100644 index 0000000..7310875 --- /dev/null +++ b/docs/capng_print_caps_text.3 @@ -0,0 +1,24 @@ +.TH "CAPNG_PRINT_CAPS_NUMERIC" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_print_caps_text \- print names of values for capabilities set +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +char *capng_print_caps_text(capng_print_t where, capng_type_t which); + +.SH "DESCRIPTION" + +capng_print_caps_text will create a text string representation of the internal capability set specified. The representation can be sent to either stdout or a buffer by passing CAPNG_PRINT_STDOUT or CAPNG_PRINT_BUFFER respectively for the where parameter. If the option was for a buffer, this function will malloc a buffer that the caller must free. + +The legal values for the which paramemeter is CAPNG_EFFECTIVE, CAPNG_PERMITTED, CAPNG_INHERITABLE, or CAPNG_BOUNDING_SET. + +.SH "RETURN VALUE" + +If CAPNG_PRINT_BUFFER was selected for where, this will be the text buffer and NULL on failure. If CAPNG_PRINT_STDOUT was selected then this value will be NULL no matter what. + +.SH "SEE ALSO" + +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_restore_state.3 b/docs/capng_restore_state.3 new file mode 100644 index 0000000..509972d --- /dev/null +++ b/docs/capng_restore_state.3 @@ -0,0 +1,23 @@ +.TH "CAPNG_SAVE_STATE" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_restore_state \- set the internal library state +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +void capng_restore_state(void **state); + +.SH "DESCRIPTION" + +capng_restore_state is a function that takes the state information previously saved by capng_save_state and restores the libraries internal state. This function is not available in the python bindings. + +.SH "RETURN VALUE" + +None. + +.SH "SEE ALSO" + +.BR capng_save_state (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_save_state.3 b/docs/capng_save_state.3 new file mode 100644 index 0000000..eecdc8f --- /dev/null +++ b/docs/capng_save_state.3 @@ -0,0 +1,23 @@ +.TH "CAPNG_SAVE_STATE" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_save_state \- get the internal library state +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +void *capng_save_state(void); + +.SH "DESCRIPTION" + +capng_save_state is a function that returns a pointer to the internal state of the libcap-ng library. It should be considered opaque and not for alteration directly. This function should be used when you suspect a third party library may use libcap-ng also and want to make sure it doesn't alter something important. This function is not available in the python bindings. + +.SH "RETURN VALUE" + +This returns NULL on failure and a non-NULL pointer otherwise. + +.SH "SEE ALSO" + +.BR capng_restore_state (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_set_caps_fd.3 b/docs/capng_set_caps_fd.3 new file mode 100644 index 0000000..3c3e399 --- /dev/null +++ b/docs/capng_set_caps_fd.3 @@ -0,0 +1,24 @@ +.TH "CAPNG_SET_CAPS_FD" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_set_caps_fd \- +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_set_caps_fd(int fd); + +.SH "DESCRIPTION" + +This function will write the file based capabilities to the extended attributes of the file that the descriptor was opened against. The bounding set is not included in file based capabilities operations. Note that this function will only work if compiled on a kernel that supports file based capabilities such as 2.6.2 +6 and later. + +.SH "RETURN VALUE" + +This returns 0 on success and -1 on failure. + +.SH "SEE ALSO" + +.BR capng_get_caps_fd (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_setpid.3 b/docs/capng_setpid.3 new file mode 100644 index 0000000..3de6777 --- /dev/null +++ b/docs/capng_setpid.3 @@ -0,0 +1,23 @@ +.TH "CAPNG_SETPID" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_setpid \- set working pid +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +void capng_setpid(int pid); + +.SH "DESCRIPTION" + +capng_pid sets the working pid for capabilities operations. This is useful if you want to get the capabilities of a different process. + +.SH "RETURN VALUE" + +None. + +.SH "SEE ALSO" + +.BR capng_get_caps_process (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_update.3 b/docs/capng_update.3 new file mode 100644 index 0000000..9a40669 --- /dev/null +++ b/docs/capng_update.3 @@ -0,0 +1,23 @@ +.TH "CAPNG_UPDATE" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_update \- update the stored capabilities settings +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_update(capng_act_t action, capng_type_t type,unsigned int capability); + +.SH "DESCRIPTION" + +capng_update will update the internal posix capabilities settings based on the options passed to it. The action should be eith CAPNG_DROP to set the capability bit to 0, or CAPNG_ADD to set the capability bit to 1. The operation is performed on the capability set specified in the type parameter. The values are: CAPNG_EFFECTIVE, CAPNG_PERMITTED, CAPNG_INHERITABLE, CAPNG_BOUNDING_SET. The values may be or'ed together to perform the same operation on multiple sets. The last paramter, capability, is the capability define as given in linux/capability.h. + +.SH "RETURN VALUE" + +This returns 0 on success and -1 on failure. + +.SH "SEE ALSO" + +.BR capng_updatev (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb diff --git a/docs/capng_updatev.3 b/docs/capng_updatev.3 new file mode 100644 index 0000000..2180f86 --- /dev/null +++ b/docs/capng_updatev.3 @@ -0,0 +1,26 @@ +.TH "CAPNG_UPDATEV" "3" "June 2009" "Red Hat" "Libcap-ng API" +.SH NAME +capng_updatev \- update the stored capabilities settings +.SH "SYNOPSIS" +.B #include <cap-ng.h> +.sp +int capng_updatev(capng_act_t action, capng_type_t type, + unsigned int capability, ...); + +.SH "DESCRIPTION" + +capng_updatev will update the internal posix capabilities settings based on the options passed to it. The action should be eith CAPNG_DROP to set the capability bit to 0, or CAPNG_ADD to set the capability bit to 1. The operation is performed on the capability set specified in the type parameter. The values are: CAPNG_EFFECTIVE, CAPNG_PERMITTED, CAPNG_INHERITABLE, CAPNG_BOUNDING_SET. The values may be or'ed together to perform the same operation on multiple sets. The last paramter, capability, is the capability define as given in linux/capability.h. + +This function differs from capng_update in that you may pass a list of capabilities. This list must be terminated with a -1 value. + +.SH "RETURN VALUE" + +This returns 0 on success and -1 on failure. + +.SH "SEE ALSO" + +.BR capng_update (3), +.BR capabilities (7) + +.SH AUTHOR +Steve Grubb |