Re: [PATCH] exporting capability code/name pairs (try #4)

Kohei KaiGai
2008-02-13T08:16:45Z

Alexey Dobriyan wrote:
> On Tue, Feb 12, 2008 at 10:10:06AM +0900, Kohei KaiGai wrote:
>> Alexey Dobriyan wrote:
>>> On Fri, Feb 08, 2008 at 06:42:09PM +0900, Kohei KaiGai wrote:
>>>> [kaigai@saba ~]$ ls -R /sys/kernel/capability/
>>>> /sys/kernel/capability/:
>>>> codes names version
>>>>
>>>> /sys/kernel/capability/codes:
>>>> 0 10 12 14 16 18 2 21 23 25 27 29 30 32 4 6 8
>>>> 1 11 13 15 17 19 20 22 24 26 28 3 31 33 5 7 9
>>>>
>>>> /sys/kernel/capability/names:
>>>> cap_audit_control cap_kill cap_net_raw cap_sys_nice
>>>> cap_audit_write cap_lease cap_setfcap cap_sys_pacct
>>>> cap_chown cap_linux_immutable cap_setgid cap_sys_ptrace
>>>> cap_dac_override cap_mac_admin cap_setpcap cap_sys_rawio
>>>> cap_dac_read_search cap_mac_override cap_setuid
>>>> cap_sys_resource
>>>> cap_fowner cap_mknod cap_sys_admin cap_sys_time
>>>> cap_fsetid cap_net_admin cap_sys_boot
>>>> cap_sys_tty_config
>>>> cap_ipc_lock cap_net_bind_service cap_sys_chroot
>>>> cap_ipc_owner cap_net_broadcast cap_sys_module
>>>> [kaigai@saba ~]$ cat /sys/kernel/capability/codes/20
>>>> cap_sys_pacct
>>>> [kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod
>>>> 27
>>>> [kaigai@saba ~]$
>>>> --------------------------------------------------------
>>>> Any comment please.
>>> You don't like 1 (one) /proc/capabilities, why?
>> I have no preference whether a single /proc/capabilities, or the current
>> approach.
>> However, this idea requires a bit more cost to lookup a capability not
>> sequencially.
>
> And I'm sure far less memory wasted at runtime.
>
> Also, adding config option for one file/directory seems ridiculous to
> me. And changelog completely fails to mention why it is useful to lookup
> capabilities by name and number -- CAP_SYS_* numbers are part of ABI,
> they won't change.

The codes of capabilities are not removed/modified, but a new one
may be added. In actually, two capabilities will be added at 2.6.25.
If we don't have dynamic interface to obtain the list of capabilities,
libcap built on older kernel cannot work enough on the latest one.

I'll add a description to make clear its purpose in the next patch.
Please wait for a while.