Unix/Linux Go Back    


CentOS 7.0 - man page for cap_get_file (centos section 3)

Linux & Unix Commands - Search Man Pages
Man Page or Keyword Search:   man
Select Man Page Set:       apropos Keyword Search (sections above)


CAP_GET_FILE(3) 		    Linux Programmer's Manual			  CAP_GET_FILE(3)

NAME
       cap_get_file, cap_set_file, cap_get_fd, cap_set_fd - capability manipulation on files

SYNOPSIS
       #include <sys/capability.h>

       cap_t cap_get_file(const char *path_p);

       int cap_set_file(const char *path_p, cap_t cap_p);

       cap_t cap_get_fd(int fd);

       int cap_set_fd(int fd, cap_t caps);

       Link with -lcap.

DESCRIPTION
       cap_get_file()  and cap_get_fd() allocate a capability state in working storage and set it
       to represent the capability state of the pathname pointed to by path_p or the file open on
       descriptor  fd.	 These	functions return a pointer to the newly created capability state.
       The effects of reading the capability state from any file other than  a	regular  file  is
       undefined.   The  caller  should  free any releasable memory, when the capability state in
       working storage is no longer required, by calling cap_free() with the  used  cap_t  as  an
       argument.

       cap_set_file()  and cap_set_fd() set the values for all capability flags for all capabili-
       ties for the pathname pointed to by path_p or the file open on  descriptor  fd,	with  the
       capability  state identified by cap_p.  The new capability state of the file is completely
       determined by the contents of cap_p.  A NULL value for cap_p  is  used  to  indicate  that
       capabilities  for the file should be deleted.  For these functions to succeed, the calling
       process must have the effective capability, CAP_SETFCAP, enabled and either the	effective
       user  ID  of  the  process  must match the file owner or the calling process must have the
       CAP_FOWNER flag in its effective capability set.  The effects of  writing  the  capability
       state to any file type other than a regular file are undefined.

RETURN VALUE
       cap_get_file() and cap_get_fd() return a non-NULL value on success, and NULL on failure.

       cap_set_file() and cap_set_fd() return zero on success, and -1 on failure.

       On  failure, errno is set to EACCES, EBADFD, ENAMETOOLONG, ENOENT, ENOMEM, ENOTDIR, EPERM,
       or EROFS.

CONFORMING TO
       These functions are specified by withdrawn POSIX.1e draft specification.

NOTES
       Support for file capabilities is provided on Linux since version 2.6.24.

       On Linux, the file Effective set is a single bit.  If it is enabled,  then  all	Permitted
       capabilities are enabled in the Effective set of the calling process when the file is exe-
       cuted; otherwise, no capabilities are enabled in the process's Effective set following  an
       execve(2).   Because  the file Effective set is a single bit, if any capability is enabled
       in the Effective set of the cap_t given to cap_set_file() or cap_set_fd(), then all  capa-
       bilities  whose Permitted or Inheritable flag is enabled must also have the Effective flag
       enabled.  Conversely, if the Effective bit is enabled on a file, then the  cap_t  returned
       by  cap_get_file() and cap_get_fd() will have the Effective flag enabled for each capabil-
       ity that has the Permitted or Inheritable flag enabled.

SEE ALSO
       libcap(3), cap_clear(3), cap_copy_ext(3), cap_from_text(3), cap_get_proc(3),  cap_init(3),
       capabilities(7)

					    2008-05-11				  CAP_GET_FILE(3)
Unix & Linux Commands & Man Pages : ©2000 - 2018 Unix and Linux Forums


All times are GMT -4. The time now is 05:34 AM.