Re: [PATCH] exporting capability code/name pairs (try #4)

Alexey Dobriyan
2008-02-12T21:58:45Z

On Tue, Feb 12, 2008 at 10:10:06AM +0900, Kohei KaiGai wrote:
> Alexey Dobriyan wrote:
> >On Fri, Feb 08, 2008 at 06:42:09PM +0900, Kohei KaiGai wrote:
> >>[kaigai@saba ~]$ ls -R /sys/kernel/capability/
> >>/sys/kernel/capability/:
> >>codes names version
> >>
> >>/sys/kernel/capability/codes:
> >>0 10 12 14 16 18 2 21 23 25 27 29 30 32 4 6 8
> >>1 11 13 15 17 19 20 22 24 26 28 3 31 33 5 7 9
> >>
> >>/sys/kernel/capability/names:
> >>cap_audit_control cap_kill cap_net_raw cap_sys_nice
> >>cap_audit_write cap_lease cap_setfcap cap_sys_pacct
> >>cap_chown cap_linux_immutable cap_setgid cap_sys_ptrace
> >>cap_dac_override cap_mac_admin cap_setpcap cap_sys_rawio
> >>cap_dac_read_search cap_mac_override cap_setuid
> >>cap_sys_resource
> >>cap_fowner cap_mknod cap_sys_admin cap_sys_time
> >>cap_fsetid cap_net_admin cap_sys_boot
> >>cap_sys_tty_config
> >>cap_ipc_lock cap_net_bind_service cap_sys_chroot
> >>cap_ipc_owner cap_net_broadcast cap_sys_module
> >>[kaigai@saba ~]$ cat /sys/kernel/capability/codes/20
> >>cap_sys_pacct
> >>[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod
> >>27
> >>[kaigai@saba ~]$
> >>--------------------------------------------------------
> >>Any comment please.
> >
> >You don't like 1 (one) /proc/capabilities, why?
>
> I have no preference whether a single /proc/capabilities, or the current
> approach.
> However, this idea requires a bit more cost to lookup a capability not
> sequencially.

And I'm sure far less memory wasted at runtime.

Also, adding config option for one file/directory seems ridiculous to
me. And changelog completely fails to mention why it is useful to lookup
capabilities by name and number -- CAP_SYS_* numbers are part of ABI,
they won't change.