aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2016-02-07Clean up ambient support and add a smoke test for them.HEADmasterAndrew G. Morgan4-83/+230
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2016-02-06Add initial support for the ambient set.Andrew G. Morgan4-78/+219
The ambient set is some strangeness associated with trying to revive naive inheritance. While personally not a fan of this feature, I recognize it is in the kernel so libcap now supports it with three new functions: int cap_get_ambient(cap_value_t cap) int cap_set_ambient(cap_value_t cap, cap_flag_value_t set) int cap_reset_ambient(void) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2016-02-06Add something to run libcap's quicktest tests against development kernel.Andrew G. Morgan8-2/+107
The kdebug directory requires qemu to run and expects the kernel to be compiled with the running architecture. My setup has the kernel sources as a peer to the libcap directory so kdebug assumes that too. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2016-01-31Fix tyop in a comment.Andrew G Morgan1-1/+1
Thanks to P.J.Opalinski for noticing it. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2016-01-30Up the minor release number.libcap-korg-2.25libcap-2.25Andrew G Morgan1-1/+1
Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2016-01-30Update to Linus' kernel tree uapi headers.Andrew G. Morgan2-2/+20
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2016-01-30Delete unused #define (magit numbers from <linux/xattr.h>)Andrew G. Morgan1-5/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2016-01-30setcap: fix errno displayAndrew G. Morgan1-1/+2
The commit 056ffb0bd25d91ffbcb83c521fc4d3d9904ec4d4 broke the display of the final error message because it would do more operations that would clobber errno. Example: (libcap-2.22) sudo setcap cap_ipc_lock=ep /proc/filesystems | head -1 Failed to set capabilities on file `/proc/filesystems' (Operation not supported) (libcap-2.23) sudo setcap cap_ipc_lock=ep /proc/filesystems | head -1 Failed to set capabilities on file `/proc/filesystems' (Invalid argument) Save the original errno value and use that for the final display instead. URL: https://bugs.gentoo.org/551672 Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2016-01-30ignore the place I stage user contributed patches for import.Andrew G. Morgan1-0/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2016-01-30Sigh. Compiling capsh statically and we get no getpw*() functions.Andrew G. Morgan1-6/+10
This is, at least, true on my Fedora based system. The chroot tests won't work with a dynamic binary, so stop using --user and use --uid instead. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2016-01-30Drop use of libattr for our trivial use case of kernel API.Andrew G. Morgan4-17/+18
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2014-05-31don't include FAKEROOT in Makefile variablesBenedikt Morbach5-23/+23
instead, prepend it when actually using them. This makes the variables more useful for specifying on the make invocation, as you don't have to repeat your FAKEROOT/DESTDIR for every variable you want to set. Just like you can set 'lib' without specifying lib_prefix. compare: make DESTDIR="${somevar}" prefix=/usr/local LIBDIR="${somevar}"/usr/local/lib96 MANDIR="${somevar}"/usr/share/man to: make DESTDIR="${somevar}" prefix=/usr/local LIBDIR=/usr/local/lib96 MANDIR=/usr/share/man Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2014-05-31Fix typo in man pageOmair Majid1-1/+1
Replace 'cap_d' with 'cap_t' in man page. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2014-04-01Make.Rules: add gperf detection and fix INDENT testMatthieu Crapet2-2/+3
Move gperf detection from libcap/Makefile to Make.Rules to be more cross-environment friendly. Fix INDENT test (dollar sign must be doubled): http://www.gnu.org/software/make/manual/make.html#Variables-in-Recipes Signed-off-by: Matthieu Crapet <mcrapet@gmail.com> Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2014-03-09Change the location we include linux/xattr.hAndrew G Morgan2-1/+2
This header stuff seems a bit fragile, but Serge reports including it in sys/capability.h was causing a lot of trouble building dependent app packages. From the perspective of libcap, this API is only needed internally in cap_file.c so we put an include there. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2014-01-05Updated release to 2.24libcap-korg-2.24libcap-2.24Andrew G Morgan1-1/+1
Release notes here: https://sites.google.com/site/fullycapable/ Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2014-01-03libcap: fix dead/empty urls.Xose Vazquez Perez2-2/+2
Cc: Andrew G. Morgan <morgan@kernel.org> Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com> Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2014-01-05Fix libcap build issue - remove spurious /uapiAndrew G Morgan1-1/+1
Thanks to Allan McRae for resolving it. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2014-01-01Fix up the uapi/linux include scheme.Andrew G Morgan5-228/+53
In adopting this uapi header file (without kernel internals), I previously messed up on the apparent location of the files. Thanks to Tom Gundersen for the clarification. Also, delete the non-uapi copies of things since they are no longer needed to build the library and tools. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-27Upload to kernel.org is of the tar file with accompanying signature.Andrew G Morgan1-1/+2
I used to sign the .gz files with my old DSA key, but now will only be signing the raw tar files with my kernel.org upload key. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-27Adjustments to point to kernel.org locations.Andrew G Morgan3-10/+142
Also include a copy of the public key I have to use to upload binaries to kernel.org. Moving forward, I plan to sign release tags with both keys. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-27Explore using this key to upload to kernel.orgAndrew G Morgan1-1/+1
Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-24Prepare for a release tag.libcap-korg-2.23libcap-2.23Andrew G Morgan2-2/+2
Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-24Stop using ping to test privilege use.Andrew G Morgan1-18/+26
It appears that ping has been modified to hard-code non-file-capability acquired privilege use. That is, it requires PR_SET_KEEPCAPS (a legacy supporting secure bit) to function in order for ping to work. As such, we can't rely on it for quicktest.sh. Instead, we use a copy of capsh enhanced with file-caps for our test cases. Thanks to Serge Hallyn @ Ubuntu for figuring out what broke. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-24Add support for power-pc build.Andrew G Morgan1-2/+2
Patch contributed by Ivan Kabaivanov. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-24Clean up some signed vs. unsigned comparisons in libcap.Andrew G Morgan4-10/+19
Suggestion from Mark Wielaard @ Redhat and, more recently from Akhil Arora @ Intel. Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-24Add a .pc file to the library.Andrew G Morgan4-2/+27
This patch was generated by Bryan Kadzban, and most recently supported by Thomas H.P. Anderson. For more info on what this file is used for, read: http://en.wikipedia.org/wiki/Pkg-config Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2013-12-14Get the library to compile again.Andrew G Morgan4-380/+379
Signed-off-by: Andrew G Morgan <morgan@kernel.org>
2011-07-30setcap: comment to help the user figure out why setcap is failing.Andrew G. Morgan1-2/+25
The file capabilities are not as expressive as process capabilities (for a reason - see the NOTES section of 'man 3 cap_set_file'). The effective bits on a file under linux are captured by a single boolean. As such attempting to partially set effective bits via the more fully expressive process capability representation (cap_from_text) sometimes yields an error. From now on, suggest that when the user attempts to do this and an error occurs, the error might be such a mismatch between effective and the other capability bits. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-07-30Fix a compiler warning(error) for format mismatch.Andrew G. Morgan1-1/+2
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-07-24This is release 2.22.libcap-2.22Andrew G. Morgan2-1/+5
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-07-24Change directory to "/" after --chroot operation.Andrew G. Morgan3-1/+15
Thanks to Steve Grubb for suggesting this. He wrote: ========= I was reviewing something recently and discovered a problem in capsh. The capsh program has a --chroot command line option. Inspecting the code shows that it does not do a chdir("/") after calling chroot. This means that '.' is outside the chroot. Additional info: http://cwe.mitre.org/data/definitions/243.html ========= Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-07-24Clarify version of GPL covering this library.Andrew G. Morgan1-4/+348
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-06-12Support getting/setting capabilities on large files.Andrew G. Morgan1-1/+1
See: https://bugs.launchpad.net/ubuntu/+source/libcap2/+bug/794202 Patch originally from Mikhail Kulinich, but forwarded from Serge Hallyn at Canonical. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-04-28This is release 2.21.libcap-2.21Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-04-25Add some bounding set capability support to libcap.Andrew G. Morgan9-14/+110
Include some documentation and a link to capsh's man page. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-01-18This is version 2.20.libcap-2.20Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2011-01-18libcap: introduce CAP_SYSLOGSergey Senozhatsky1-1/+6
Since commit 38ef4c2e437d11b5922723504b62824e96761459 syslog operations require CAP_SYSLOG capability (intoriduced by commit ce6ada35bdf710d16582cc4869c26722547e6f11), not CAP_SYS_ADMIN. Patch introduces CAP_SYSLOG capability. Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
2010-08-08Default to installing setcap with an inheritable capability.Andrew G. Morgan6-7/+46
For my conveneince, default to installing an inheritable file capability on setcap when installed. This requires the process inherit a capability for it to take effect, but that's what pam_cap is for... You can disable this install feature with: make RAISE_SETFCAP=no install Also, clean up Make files and a test, and add more comments. The make files needed a fix (remove -lpam from pam_cap/Makefile) and I've added a number of comments in support of various issues folk have asked me about. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2010-08-08fix MakefilesTorsten Werner4-10/+9
This patch allows modifications of $(CFLAGS) when invoking make and fixes some library linking issues. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2010-07-21Merge branch 'master' of ssh://master.kernel.org/pub/scm/libs/libcap/libcapAndrew G. Morgan1-1/+1
2010-07-21fix manpage cap_from_text(3)Torsten Werner1-2/+2
thanks to Roland Koebler for the new text Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2010-01-13This is libcap-2.19libcap-2.19Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2010-01-11Clean up of prctl code.Andrew G. Morgan4-10/+163
Also add linux securebits.h file in case the system headers did not include them. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2010-01-11define sys/securebits.hSerge E. Hallyn1-0/+22
Hey Andrew, Do you think this belongs in libcap? I figure it looks nice sitting next to include/sys/capability.h... But can't convince myself whether it's useful or not. Signed-off-by: Serge Hallyn <serge@us.ibm.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2010-01-03Add a test for maximal lock-down.Andrew G. Morgan2-29/+70
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2009-12-27Update to latest kernel header 2.6.33.Andrew G. Morgan1-3/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2009-12-25This is libcap-2.18libcap-2.18Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2009-12-25Oops. Don't reuse index for loop.Andrew G. Morgan1-3/+3
i -> j. The previous code would loop infinitely with --user=<user-with-one-group> --print Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2009-11-23New features (setting user and groups)Andrew G. Morgan2-18/+149
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2009-11-22Checkpoint.Andrew G. Morgan3-4/+149
2009-11-22getcap(8): fix filename section splitMike Frysinger1-1/+2
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
2009-11-22etcap(8): use .BR in SEE ALSOMike Frysinger2-6/+6
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
2009-08-26This is libcap-2.17.libcap-2.17Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2009-08-26Fix test to actually test setuid-0 scripts don't get capabilities.Andrew G. Morgan1-1/+5
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2009-08-26Update kernel header to more recent version.Andrew G. Morgan2-16/+73
Also clean up header to avoid hackery - no longer needed apparently. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2009-08-26Fix recent compilation issue - by reordering #includes.Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@pip.(none)>
2008-12-03This is libcap-2.16.libcap-2.16Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-12-03Stop using sed for parsing capability.h.Andrew G. Morgan3-9/+9
I've had a number of reports that some systems are using really old versions of sed that don't honor the '\t' for tabs in rules. Since perl does, we'll use that from here on. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-11-20Fix getcap utility in recursive modelibcap-2.15Lukas Kuklinek1-40/+29
When scanning filesystem subtree with symbolic links to parent directories the old code would get into an infinite loop. This fixes the code to not follow symbolic links. Relevant bugzilla entry: https://bugzilla.redhat.com/show_bug.cgi?id=454987 [Ed., Minor style modifications by Andrew] Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-11-17Make.Rules: fix INDENT testMike Frysinger1-1/+1
The indent variable has a test to see if indent is installed, but the test logic is inverted and has a typo in the binary name. [Ed. The typos were part of my tests that the tests were working, and then I absent mindedly checked it in!?! Thanks Mike for spotting it. :*) ] Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-11-10The next release will be 2.15.Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-11-10Makefile tweaks mostlyAndrew G. Morgan7-8/+49
add rule to build HTML add LIBATTR=no makefile support for not including filesystem support comment cleanup for cap_file.c. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-26libc as a way to infer library directory doesn't work on ubuntu.Andrew G. Morgan1-1/+1
This appears to work on both redhat and ubuntu (at least the two distributions I'm using). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-25Update for release of 2.14.libcap-2.14Andrew G. Morgan2-20/+7
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-24No longer need verify-caps since setcap -v performs this operation.Andrew G. Morgan2-77/+2
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-24Documentation for setcap reconciled with application.Andrew G. Morgan2-5/+25
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-24Record the fact that setcap has raised CAP_SETFCAP.Andrew G. Morgan1-0/+1
[This was mistakenly omitted from the last check in.] Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-23Add a -v (verify) mode to setcapAndrew G. Morgan1-27/+66
This seems like a more logical place to put a verify capabilities than inventing a new program just for that purpose. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-23A handy --decode=0xYYYYY flag for capsh.Andrew G. Morgan1-0/+25
You can use this to manually decode entries in /proc/<PID>/status. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-19Make programs dynamically linked.Andrew G. Morgan2-0/+4
Suggestion from the Slackware folk (Thanks Robby Workman for pointing out Pat's change). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-19Add an example program to verify that a file has specific capabilities.Andrew G. Morgan4-4/+81
This program is not installed by default. Its more of a code sample to help folk trying to put such checks into other programs (package managers for example). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-1612 was annoying to use. Let's hear it for 13.libcap-2.13Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-16Another corner case not gracefully handled by cap_to_text.Andrew G. Morgan2-4/+7
This shows up when you try to run getpcaps on a system still running with 32-bit capabilities. The output is very verbose for a process with no capabilities. Now it yields '='. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-16Make rules were not complete for compiling on unprepared systems.Andrew G. Morgan3-3/+4
Reported-by: Ulf Grüne <ulf.gruene@t-online.de> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-08Next release 2.12.libcap-2.12Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-10-08Remove support for kernel feature never implemented.Andrew G. Morgan1-44/+3
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-09-10Restore correct source location for <sys/capability.h>Andrew G. Morgan2-4/+5
Reported-by: Robby Workman <rworkman@slackware.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-07-29A libcap.3 man page and fix up the cap_get_pid() docs.Andrew G. Morgan9-15/+149
Make it easier to find what functions are available in the API. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-07-09Install the new man page (link)Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-07-09This is libcap-2.11.libcap-2.11Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-07-09Up to date with Linus' tree.Andrew G. Morgan1-1/+3
This change should not impact any code. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-07-09Document updates - add cap_compare man page.Andrew G. Morgan3-4/+30
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-07-08Fix cap_copy_int(), add two functions cap_get_pid() and cap_compare()Andrew G. Morgan10-28/+82
Test new and old function with modified test. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-07-06Fix for Debian bugs 400591 & 487223: cap_copy_ext()Andrew G. Morgan3-10/+59
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=400591 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=487223 Correct fix implemented as suggested by Matt. Reported-by: Matt Kern <matt.kern@undue.org> Reported-by: Torsten Werner <twerner@debian.org> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-06-29Make text representation more readable.Andrew G. Morgan1-1/+9
When the most compact representation of a set of capabilities involves displaying unnamed capabilities (with numbers), folk find the output unreadable. With this change, we make an attempt to avoid ever printing numeric capabilities in the common cases for capability sets. Reported-by: Serge E. Hallyn <serue@us.ibm.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-06-23Leverage a different, more standard, location for xattr.h .Andrew G. Morgan1-1/+1
Reported-by: Lee Essen <lee.essen@owlsbarn.co.uk> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-06-02Some makefile cleanups.Andrew G. Morgan5-30/+30
All the good parts of this change are Mike Frysinger's <vapier@gentoo.org> work. Everything that is broken, is due to my mangling of it. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-30Make fixes.Hao Xu2-2/+2
Don't need to do -O2 twice. Install the static library with the static libraries name(!) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-26This is libcap-2.10.libcap-2.10Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-26We're moving on to v3 capabilities, to overcome a header file snafu.Andrew G. Morgan5-16/+57
v3 capabilities are functionally equivalent to v2 capabilities, but having a different magic value allow the kernel to warn about possibly unsafe use of v2 capabilities. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-24Drop dependency on current value of _LINUX_CAPABILITY_VERSIONAndrew G. Morgan4-12/+23
Be more explicit with a local definition of _LIBCAP_CAPABILITY_* to indicate the libraries preferred capability revision. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-13Better grammar for cap_from_text.3.Michael Kerrisk1-8/+9
[Minor edits by AGM - who prefers nul to null for the '\0' vs. '(void *) 0'] Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-12Enhancements to cap_copy_ext.3.Michael Kerrisk1-19/+16
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-12cap_get_proc.3 enhancements.Michael Kerrisk1-9/+40
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-12Enhancements with example to cap_from_text.3.Michael Kerrisk1-17/+70
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-12Documentation clarifications.Michael Kerrisk1-24/+34
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-12Minor fixup.Andrew G. Morgan1-6/+8
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-12cap_get_file.3 updates.Michael Kerrisk1-5/+29
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-12Fixes for cap_init.3.Michael Kerrisk1-4/+9
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-09More doc fixesMichael Kerrisk7-26/+35
[AGM folded in a couple of minor things too - and a .gitignore change.] Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-09Merge branch 'master' of ssh://master.kernel.org/pub/scm/libs/libcap/libcapAndrew G. Morgan1-1/+1
2008-05-09Modernize discussion of capsetp().Andrew G. Morgan1-35/+32
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-09Indicate fate of POSIX.1e draft.Michael Kerrisk6-10/+8
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-09More consistent link lines.Michael Kerrisk6-18/+12
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-09Added note about capabilities(7) from the main system man pages.Michael Kerrisk6-6/+12
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-05-09Man page cleanup - consistent style.Michael Kerrisk6-103/+106
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-04-30this is libcap-2.09libcap-2.09Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-04-28Clean up in preparation for next release.Andrew G. Morgan2-6/+3
Don't install non-existent man pages. Update kernel header from latest 2.6.26 git tree. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-04-28These two man pages are no longer officialAndrew G. Morgan2-42/+0
See http://www.kernel.org/pub/linux/docs/man-pages/ for documentation on the kernel system calls. Reported-by: Michael Kerrisk <mtk.manpages@googlemail.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-04-27Revised numbers for the SECUREBITS prctl()sAndrew G. Morgan2-4/+4
Andrew Morton said: The hitherto-invisible-to-me PR_GET_TSC and PR_SET_TSC have turned up in mainline, so I have renumbered your prctl options to /* Get/set securebits (as per security/commoncap.c) */ #define PR_GET_SECUREBITS 27 #define PR_SET_SECUREBITS 28 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-04-13Add stub man page for cap_clear_flag.3Andrew G. Morgan2-1/+2
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-03-30Chris' capability conversion scripts.Chris Friedhoff3-0/+805
2008-03-30Figured out how and where to install pam_cap.soAndrew G. Morgan3-11/+8
Also fixed a bug with config= module argument. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-03-29Add cap_clear_flag() function to clear one of the EIP capability flag vectorsAndrew G. Morgan4-7/+48
This function makes modifying only one of E I and P sets easier. cap_clear() = cap_clear_flag(,E) + cap_clear_flag(,I) + cap_clear_flag(,P) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-03-27Make a better guess for the target directory for libcap.Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-03-09Add info about -r option to documentation for setcapAndrew G. Morgan1-1/+3
2008-03-06Added missing rm -f ./ping to quicktest.sh (for early exit)Chris Friedhoff1-0/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-03-05This is 2.08.libcap-2.08Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-03-05Clean up more things in progs (side effects of failing quicktest.sh)Andrew G. Morgan1-1/+1
2008-03-05Address a bug manipulating 32-bit text representations of capabilities.Andrew G. Morgan1-24/+53
Reported separately by Serge and Chris Friedoff.
2008-03-05Add a test for all= capability setting etc, support.Andrew G. Morgan1-7/+16
2008-03-01Rearranged order to support bailing early if no securebits support availableAndrew G. Morgan1-17/+25
Also activated test for 2.6.24 bug (fixed by serge in 2.6.25)
2008-02-27Revert "Add CAP_NS_OVERRIDE (34)."Andrew G. Morgan1-8/+1
This reverts commit 6f8418fa5e8a253970e317600cb963ff45fbe24e. Serge says this was premature (and Andrew says my bad).
2008-02-26Add support for Kohei KaiGai's /sys/kernel/capability/ files.Andrew G. Morgan2-20/+71
This change adds support for checking for new capabilities in the /sys/kernel/capability/{codes,names}/* files when the library wasn't compiled with the latest capabilities. Also update documentation for cap_from_text.3 to be more explicit about how to free a libcap allocated string. (Bug reported by Serge.) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-23Update release number to 2.07.libcap-2.07Andrew G. Morgan1-1/+1
2008-02-22Fix libcap to build while using more than one make jobChristian Wiese1-1/+1
Fixes build issues while using more than one make job, assuring that cap_names.h is generated before compiling cap_text.c. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-21Extend capsh with --caps= --killit= --forkfor= and == supportAndrew G. Morgan2-6/+115
Add these features to capsh, and add two new test cases to quicktest.sh (inspired by wireshark) for keeping an eye on legacy --keep functionality: --caps=xxx set caps as per cap_from_text() --killit=<n> send signal(n) to child --forkfor=<n> fork and make child sleep for <n> sec == re-exec(capsh) with args as for -- Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-17Do not hard code toolchain binariesMike Frysinger2-3/+5
If you are cross-compiling, you cannot execute `ar` and `ranlib` on the target library, otherwise things may break. Here we create standard AR and RANLIB variables which can easily be overridden by the environment. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-17Do not run ldconfig for FAKEROOT installsMike Frysinger1-0/+2
If you're installing into a temporary directory, then running ldconfig will simply waste CPU and I/O time. The install location will not be any path that ldconfig searches, and generally people build as non-root so the ldconfig binary will run for a while before erroring out due to lack of permissions. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-17Add .gitignore filesMike Frysinger4-0/+13
Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-17do not use the '-s' flag with `install`Mike Frysinger1-1/+1
The `install` program strips binaries when given the '-s' flag. This step should be left up to package maintainers to handle the stripping, especially since the `install` program will always execute `strip` -- this is no good for cross-compiling for example. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-16set FAKEROOT to DESTDIR by defaultMike Frysinger1-1/+1
Since the DESTDIR variable is the common standard for installing into a staging directory, the FAKEROOT variable should default to it. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-07Add CAP_NS_OVERRIDE (34).Serge E. Hallyn1-1/+8
Signed-off-by: Andrew G. Morgan <morgan@kernel.org> Signed-off-by: Serge H. Hallyn <sergeh@us.ibm.com>
2008-02-07This is release 2.06.libcap-2.06Andrew G. Morgan2-20/+22
Include copy of latest (2.6.24-mm1) capabiity.h file. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-05We don't need to export _cap_names[] any more.Andrew G. Morgan8-20/+41
I've added perfect hash generation support for looking up names (if you have gperf installed). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-02-03Support for prctl based securebits.Andrew G. Morgan2-3/+134
Add a quick regression/reference test for the various capability manipulations. (Run it as root.)
2008-01-30This commit fixes some text -> cap# mapping and works with securebits patch.Andrew G. Morgan1-1/+1
2008-01-24Merge branch 'master' of ssh://master.kernel.org/pub/scm/libs/libcap/libcapAndrew G. Morgan1-1/+1
2008-01-24Fix malloc(size) but in capsh and numeric capabilities (for unnamed bits)Andrew G. Morgan3-8/+12
capsh allocated too little memory for the --inh argument - led to glibc aborting with free(). libcap has always had latent support for identifying unnamed capabilities with integers. It was untested (and therefore broken) prior to this commit. Should be fixed now. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-01-21This is libcap-2.05libcap-2.05Andrew G. Morgan1-1/+1
- new functions: cap_{to|from}_name() - capsh test/wrapper application - optional pam_cap compilation - stricter prototypes Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-01-21Introduce a capability shell wrapper; capsh.Andrew G. Morgan3-1/+248
Capsh is a simple 'bash' wrapper program that can be used to raise and lower both the bset and pI capabilities before invoking /bin/bash (hardcoded right now). The --print option can be used as a quick test whether various capability manipulations work as expected (or not). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-01-21Introduce two new capability <-> text helper functions.Andrew G. Morgan8-44/+102
_cap_names was a really clumsy interface. With this commit, we add cap_to_name() and cap_from_name() with manual documentation too. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2008-01-17Make pam_cap compilation conditional.Andrew G. Morgan2-1/+3
Default is for make to guess if the user wants the module or not user can override with make PAM_CAP={yes|no} Thanks to Chris Freidhoff for the suggestion and a first stab at a patch. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2007-12-30Filesystem capabilities are only meaningful on regular files.libcap-2.04Andrew G. Morgan3-1/+27
Do not support putting capabilies on symlinks and directories. You can get around this with an older version of libcap, or using the raw xattr API, but there is little point; the kernel only pays attention to file capabilities when it exec()s a file. Bug report: Chris Friedhoff Suggested fix: Serge E. Hallyn Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2007-12-24Fix for 32-bit filesystem capability support.libcap-2.03Andrew G. Morgan2-8/+11
Fix a bug related to the unconditional size of the VFS capabilities. Before, the size was based on the header used to compile the library, now the default size is based on the process capabilities supported by the running kernel. Chris Friedhoff reported this bug. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2007-12-02Allocate next two capabilities for MAC security modules.Casey Schaufler1-2/+22
This is used by the SMACK LSM module in the kernel > 2.6.24-rc3-mm1.
2007-12-02Also create $(MANDIR)/man8Ismail Dönmez1-1/+1
If this directory is not created *.8 manpages will be installed incorrectly.
2007-11-17Release 2.02.libcap-2.02Andrew Morgan1-1/+1
Signed-off-by: Andrew Morgan <morgan@kernel.org>
2007-11-16The following patch to libcap enables to display file capabilitiesKaiGai Kohei2-19/+96
recursively on the enumerated directories when -r is specified. In addition, some other features are ported from my getfcap. When an entry contains no file-capabilities, displaying it will be skipped without returning an error. However, -v option enables to display those filenames with no capabilities. -h options displays short usage message. Please consider to apply it on your tree. EXAMPLE: [kaigai@saba libcap]$ ./progs/getcap -r /tmp /tmp/ping = cap_net_raw+ep [kaigai@saba libcap]$ Thanks, -- OSS Platform Development Division, NEC KaiGai Kohei <kaigai@ak.jp.nec.com>
2007-11-10This is version 2.01libcap-2.01Andrew Morgan1-1/+1
2007-11-10Prune kernel header and fix missing assignment (fixes from KaiGai Kohei)Andrew Morgan2-2/+1
- the kernel header doesn't need compiler.h included + patch submitted for upstream use. - the cap_copy_int() function was missing a crucial assignment Signed-off-by: Andrew Morgan <morgan@kernel.org>
2007-11-07This is libcap-2.00.libcap-2.00Andrew Morgan5-15/+512
This revision of libcap has support for 32-bit and 64-bit capabilities. It also supports filesystem capabilities of both sizes.
2007-10-31Add support for 64-bit (file) capabilitieslibcap-20071031Andrew Morgan10-133/+303
This should compile with any iteration of a recent (2.6) kernel. If your kernel has 64-bit capabilities support, and the kernel headers indicate this, then it will include that. 32-bit legacy kernel support is dynamically performed by such a build of libcap.
2007-08-13Give a concrete example (morgan gets CAP_SETFCAP)libcap-20070813Andrew Morgan1-2/+2
2007-08-13Build with a pam_cap module.Andrew Morgan10-56/+65
Note, I've been confused about the capset/capget system calls. It would seem that the current way(TM) is to get the raw API from libc.
2007-08-13I'm installing the pam_cap code here.Andrew Morgan5-0/+401
Since I wrote it, and reserve all rights, I'm going to rebrand it with the same license as libcap. (Will fix this an compiling etc. on the next commit.)
2007-08-13Install more man pages.Andrew Morgan1-1/+3
2007-08-13Revived old setcap/getcap manual pages and added support for removing file capsAndrew Morgan8-27/+46
2007-08-13Cleanup output; and permit setcap e value to be superset of ip.Andrew Morgan7-16/+17
This means one can say: setcap "all=e cap_net_raw=p" ping which is equivalent to setcap "cap_net_raw=ep" ping
2007-08-13Give this a different version numberAndrew Morgan1-1/+1
FWIW This value won't change until I make libcap2.
2007-08-13Add tentitive support for filesystem capabilities with 2.6.23-mm kernelsAndrew Morgan11-37/+130
2007-08-13Don't need this any more.libcap-1.97Andrew Morgan1-20/+0
2007-08-13Correct capset and capget system call invocationsAndrew Morgan2-5/+2
They come from libc now.
2007-07-30Update for 1.96 release.libcap-1.96Andrew Morgan2-2/+2
2007-07-30Enable compilation against more recent (2.6) kernel header files.Andrew Morgan1-0/+2
[Thanks to Joey Trungale for the bug report.]
2007-07-18Update key file.libcap-1.95Andrew Morgan1-10/+64
2007-07-17Support for static library creation (libcap.a) + miscAndrew Morgan4-8/+25
Incorporate fixes from Red Hat rpm (1.10-25).
2007-07-10Prepare for 1.95 release.Andrew Morgan22-419/+69
2007-07-10This is libcap-1.10libcap-1.10Andrew Morgan8-44/+127
http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/libcap-1.10.tar.gz
2007-07-10This is libcap-1.03libcap-1.03Andrew Morgan3-5/+69
http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/libcap-1.03.tar.gz
2007-07-10This is libcap-1.02libcap-1.02Andrew Morgan3-4/+21
http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/libcap-1.02.tar.gz
2007-07-10This is libcap-1.01libcap-1.01Andrew Morgan90-7697/+113
http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/libcap-1.01.tar.gz
2007-07-10This is the source for libcap-1.0.tar.gzlibcap-1.0Andrew Morgan113-0/+10926
http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/libcap-1.0.tar.gz
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-22 15:04:43 +0000