From 51201235db9dad9fe1823d9de46ed90f5e160fd0 Mon Sep 17 00:00:00 2001 From: Etienne CHAMPETIER Date: Wed, 26 Aug 2015 23:26:45 +0000 Subject: jail: add capabilities support If there is one or more capabilities in cap.keep, drop all capabilities not in cap.keep. Always drop all capabalities in cap.drop exemple json syntax: { "cap.keep": [ "cap_net_raw" ], "cap.drop": [] } Signed-off-by: Etienne CHAMPETIER --- jail/capabilities.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 jail/capabilities.h (limited to 'jail/capabilities.h') diff --git a/jail/capabilities.h b/jail/capabilities.h new file mode 100644 index 0000000..e6699e9 --- /dev/null +++ b/jail/capabilities.h @@ -0,0 +1,14 @@ +/* + * Copyright (C) 2015 Etienne CHAMPETIER + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License version 2.1 + * as published by the Free Software Foundation + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +int drop_capabilities(const char *file); -- cgit v1.2.3