[PATCH v2 7/9] setpriv: dump ambient capabilities

Patrick Steinhardt ps at pks.im
Sun Jul 2 13:42:56 UTC 2017


As with the previous commit, this commit introduces the ability to dump
the set of ambient capabilities.
---
 util-linux/setpriv.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/util-linux/setpriv.c b/util-linux/setpriv.c
index 3dc662d33..e051330c3 100644
--- a/util-linux/setpriv.c
+++ b/util-linux/setpriv.c
@@ -95,6 +95,16 @@
 #define PR_GET_NO_NEW_PRIVS 39
 #endif
 
+#ifndef PR_CAP_AMBIENT
+#define PR_CAP_AMBIENT 47
+#define PR_CAP_AMBIENT_IS_SET 1
+#endif
+
+#if ENABLE_FEATURE_SETPRIV_CAPABILITIES
+static cap_user_header_t cap_header;
+static int cap_u32s;
+#endif
+
 enum {
 	IF_FEATURE_SETPRIV_DUMP(OPTBIT_DUMP,)
 	OPTBIT_NNP,
@@ -263,6 +273,25 @@ static int dump(void)
 		printf("[none]");
 	putchar('\n');
 
+	printf("Ambient capabilities: ");
+	for (n = 0, i = 0; cap_valid(i); i++) {
+		int ret = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, (unsigned long) i, 0UL, 0UL);
+		if (ret < 0)
+			bb_simple_perror_msg_and_die("prctl: CAP_AMBIENT_IS_SET");
+
+		if (ret) {
+			if (n)
+				putchar(',');
+			printcap(i);
+			n++;
+		}
+	}
+	if (!n && !i)
+		printf("[unsupported]");
+	else if (!n)
+		printf("[none]");
+	putchar('\n');
+
 	printf("Capability bounding set: ");
 	for (n = 0, i = 0; cap_valid(i); i++) {
 		int ret = prctl(PR_CAPBSET_READ, (unsigned long) i, 0UL, 0UL, 0UL);
-- 
2.13.2



More information about the busybox mailing list