148 lines
3.7 KiB
HTML
148 lines
3.7 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of CAPABILITY.CONF</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>CAPABILITY.CONF</H1>
|
|
Section: Linux-PAM Manual (5)<BR>Updated: 09/23/2011<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
capablity.conf - configuration file for the pam_cap module
|
|
<A NAME="lbAC"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<P>
|
|
|
|
Each line of the file consists of two fields; the fields define:
|
|
<P>
|
|
|
|
<B><capability-list></B>
|
|
<P>
|
|
<DL COMPACT><DT id="1"><DD>
|
|
One or more comma-separated capabilities, specified as either the textual capability name,
|
|
or numeric capability value. Text name(s) and numeric value(s) may be intermixed.
|
|
<P>
|
|
The special capability name <B>all</B> may be used to enable all capabilities known to the local system.
|
|
<P>
|
|
The special capability name <B>none</B> may be used to disable all current inheritable capabilities.
|
|
</DL>
|
|
|
|
<P>
|
|
<DL COMPACT><DT id="2"><DD>
|
|
<B>NOTE:</B> No whitespace is pemitted between the values. The names all and none may not be combined with any other capabilities.
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<B><username></B>
|
|
<P>
|
|
<DL COMPACT><DT id="3"><DD>
|
|
One or more whitespace-separated usernames, or the wildcard <B>*</B>.
|
|
</DL>
|
|
|
|
<P>
|
|
<DL COMPACT><DT id="4"><DD>
|
|
<B>NOTE:</B> The first matching entry is used. Thus, only a single matching username entry,
|
|
and/or a single wildcard entry, may be used. A matching username entry must <I>precede</I>
|
|
the wildcard entry in order to be effective.
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<B>IMPORTANT:</B> <capability-list> <I>replaces</I> the current process' inherited capabilities;
|
|
i.e. there is no provision for adding/subtracting from the current set.
|
|
In most environments, the inheritable set of the process performing user authentication
|
|
is 0 (empty).
|
|
<P>
|
|
If any capability name or numeric value is invalid/unknown to the local
|
|
system, the capabilities will be rejected, and the inheritable set will
|
|
<B>not</B> be modified.
|
|
<A NAME="lbAD"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
<P>
|
|
|
|
These are some example lines which might be specified in
|
|
/etc/security/capability.conf.
|
|
<P>
|
|
<DL COMPACT><DT id="5"><DD>
|
|
|
|
|
|
|
|
<PRE>
|
|
# Simple
|
|
cap_sys_ptrace developer
|
|
cap_net_raw user1
|
|
|
|
# Multiple capablities
|
|
cap_net_admin,cap_net_raw jrnetadmin
|
|
# Identical, but with numeric values
|
|
12,13 jrnetadmin
|
|
|
|
# Combining names and numerics
|
|
cap_sys_admin,22,25 jrsysadmin
|
|
|
|
# Next line has no effect; user1 already matched above
|
|
5,12,13 user1
|
|
|
|
# Insure any potential capailities from calling process are dropped
|
|
none luser1 luser2
|
|
|
|
# Allow anyone to manipulate capabilities
|
|
# Will NOT apply to users matched above !
|
|
cap_setpcap *
|
|
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAE"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<P>
|
|
|
|
<P>
|
|
<B><A HREF="/cgi-bin/man/man2html?8+pam_cap">pam_cap</A></B>(8),
|
|
<B><A HREF="/cgi-bin/man/man2html?5+pam.d">pam.d</A></B>(5),
|
|
<B><A HREF="/cgi-bin/man/man2html?7+pam">pam</A></B>(7),
|
|
<B><A HREF="/cgi-bin/man/man2html?7+capabilities">capabilities</A></B>(7)
|
|
<A NAME="lbAF"> </A>
|
|
<H2>AUTHOR</H2>
|
|
|
|
<P>
|
|
|
|
pam_cap was initially written by Andrew G. Morgan <<A HREF="mailto:morgan@kernel.org">morgan@kernel.org</A>>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="6"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="7"><A HREF="#lbAC">DESCRIPTION</A><DD>
|
|
<DT id="8"><A HREF="#lbAD">EXAMPLES</A><DD>
|
|
<DT id="9"><A HREF="#lbAE">SEE ALSO</A><DD>
|
|
<DT id="10"><A HREF="#lbAF">AUTHOR</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:02 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|