[PATCH v3 3/6] setpriv: dump capability bounding set

Patrick Steinhardt ps at pks.im
Thu Jul 6 13:21:45 UTC 2017


As with the previous commit, this one implements the ability to dump the
capability bounding set.

function                                             old     new   delta
setpriv_main                                         838     982    +144
.rodata                                           146101  146148     +47

Signed-off-by: Patrick Steinhardt <ps at pks.im>
---
 util-linux/setpriv.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/util-linux/setpriv.c b/util-linux/setpriv.c
index f92a14dfc..a958e9a95 100644
--- a/util-linux/setpriv.c
+++ b/util-linux/setpriv.c
@@ -82,6 +82,10 @@
 #include <sys/prctl.h>
 #include "libbb.h"
 
+#ifndef PR_CAPBSET_READ
+#define PR_CAPBSET_READ 23
+#endif
+
 #ifndef PR_SET_NO_NEW_PRIVS
 #define PR_SET_NO_NEW_PRIVS 38
 #endif
@@ -260,6 +264,22 @@ static int dump(void)
 	}
 	if (!n)
 		printf("[none]");
+
+	printf("\nCapability bounding set: ");
+	fmt = ",%s" + 1;
+	for (n = 0, i = 0; cap_valid(i); i++) {
+		int ret = prctl(PR_CAPBSET_READ, (unsigned long) i, 0UL, 0UL, 0UL);
+		if (ret < 0)
+			bb_simple_perror_msg_and_die("prctl: CAPBSET_READ");
+
+		if (ret) {
+			printf(fmt, getcapname(buf, sizeof(buf), i));
+			n++;
+			fmt = ",%s";
+		}
+	}
+	if (!n)
+		printf("[none]");
 	bb_putchar('\n');
 #endif
 
-- 
2.13.2



More information about the busybox mailing list