1*2b3f93eaSMatthew Dillon.\" Copyright (c) 2023 Matthew Dillon <dillon@backplane.com> 2*2b3f93eaSMatthew Dillon.\" All rights reserved. 3*2b3f93eaSMatthew Dillon.\" 4*2b3f93eaSMatthew Dillon.\" Redistribution and use in source and binary forms, with or without 5*2b3f93eaSMatthew Dillon.\" modification, are permitted provided that the following conditions 6*2b3f93eaSMatthew Dillon.\" are met: 7*2b3f93eaSMatthew Dillon.\" 1. Redistributions of source code must retain the above copyright 8*2b3f93eaSMatthew Dillon.\" notice, this list of conditions and the following disclaimer. 9*2b3f93eaSMatthew Dillon.\" 2. Redistributions in binary form must reproduce the above copyright 10*2b3f93eaSMatthew Dillon.\" notice, this list of conditions and the following disclaimer in the 11*2b3f93eaSMatthew Dillon.\" documentation and/or other materials provided with the distribution. 12*2b3f93eaSMatthew Dillon.\" 13*2b3f93eaSMatthew Dillon.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14*2b3f93eaSMatthew Dillon.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15*2b3f93eaSMatthew Dillon.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16*2b3f93eaSMatthew Dillon.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17*2b3f93eaSMatthew Dillon.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18*2b3f93eaSMatthew Dillon.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19*2b3f93eaSMatthew Dillon.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20*2b3f93eaSMatthew Dillon.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21*2b3f93eaSMatthew Dillon.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22*2b3f93eaSMatthew Dillon.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23*2b3f93eaSMatthew Dillon.\" SUCH DAMAGE. 24*2b3f93eaSMatthew Dillon.\" 25*2b3f93eaSMatthew Dillon.\" $DragonFly$ 26*2b3f93eaSMatthew Dillon.\" 27*2b3f93eaSMatthew Dillon.Dd October 12, 2023 28*2b3f93eaSMatthew Dillon.Dt SETCAPS 1 29*2b3f93eaSMatthew Dillon.Os 30*2b3f93eaSMatthew Dillon.Sh NAME 31*2b3f93eaSMatthew Dillon.Nm setcaps 32*2b3f93eaSMatthew Dillon.Nd set capability restrictions on calling process 33*2b3f93eaSMatthew Dillon.Sh SYNOPSIS 34*2b3f93eaSMatthew Dillon.Nm 35*2b3f93eaSMatthew Dillon.Op Fl lpqh 36*2b3f93eaSMatthew Dillon.Op cap[:es] ... 37*2b3f93eaSMatthew Dillon.Sh DESCRIPTION 38*2b3f93eaSMatthew DillonThe 39*2b3f93eaSMatthew Dillon.Nm 40*2b3f93eaSMatthew Dillonutility sets capability restrictions on the parent process, which is 41*2b3f93eaSMatthew Dillontypically the shell that ran this program. By default the SELF and EXEC 42*2b3f93eaSMatthew Dillonflags are both set. 43*2b3f93eaSMatthew Dillon.Pp 44*2b3f93eaSMatthew DillonWhen specifying capabilities to set, a colon extension may be used to 45*2b3f93eaSMatthew Dillonoverride the default restrictions. 46*2b3f93eaSMatthew Dillon.Pp 47*2b3f93eaSMatthew Dillon.Sh OPTIONS 48*2b3f93eaSMatthew DillonThe options are as follows: 49*2b3f93eaSMatthew Dillon.Bl -tag -width indent 50*2b3f93eaSMatthew Dillon.It Fl l 51*2b3f93eaSMatthew DillonList current capabilities. 52*2b3f93eaSMatthew Dillon.It Fl p 53*2b3f93eaSMatthew DillonPrint a list of all available capabilities. 54*2b3f93eaSMatthew Dillon.It Fl q 55*2b3f93eaSMatthew DillonDo not complain if a specified capability is not available. 56*2b3f93eaSMatthew Dillon.It Fl h 57*2b3f93eaSMatthew DillonPrint help and exit. 58*2b3f93eaSMatthew Dillon.El 59*2b3f93eaSMatthew Dillon.Sh FLAGS 60*2b3f93eaSMatthew Dillon.Bl -tag -width indent 61*2b3f93eaSMatthew Dillon.It Li :s 62*2b3f93eaSMatthew DillonSets the SELF flag. The capability restriction is applied to the 63*2b3f93eaSMatthew Dilloncalling process. However, SELF restrictions are not transfered 64*2b3f93eaSMatthew Dillonupon exec unless the EXEC flag is also specified. 65*2b3f93eaSMatthew Dillon.It Li :e 66*2b3f93eaSMatthew DillonSets the EXEC flag. The capability restriction is applied to any 67*2b3f93eaSMatthew Dillonprograms exec'd by the calling process. EXEC becomes SELF when a 68*2b3f93eaSMatthew Dillonprogram is exec'd. The EXEC flag remains set. 69*2b3f93eaSMatthew DillonNote that fork alone does not activate EXEC flagged restrictions. 70*2b3f93eaSMatthew Dillon.It Li :se 71*2b3f93eaSMatthew DillonBoth flags may be specified (this is the default) for each capability 72*2b3f93eaSMatthew Dillonlisted without specified flags). 73*2b3f93eaSMatthew Dillon.El 74*2b3f93eaSMatthew Dillon.Sh EXIT STATUS 75*2b3f93eaSMatthew Dillon.Nm 76*2b3f93eaSMatthew Dillonwill exit 1 on error, and 0 on success. 77*2b3f93eaSMatthew Dillon.Sh EXAMPLES 78*2b3f93eaSMatthew Dillon.Li setcaps restricted_root 79*2b3f93eaSMatthew Dillon.Li setcaps restricted_root:se sensitive_root:se 80*2b3f93eaSMatthew Dillon.Sh SEE ALSO 81*2b3f93eaSMatthew Dillon.Xr syscap_set 2 , 82*2b3f93eaSMatthew Dillon.Xr syscap_get 2 83*2b3f93eaSMatthew Dillon.Sh HISTORY 84*2b3f93eaSMatthew DillonThe 85*2b3f93eaSMatthew Dillon.Nm 86*2b3f93eaSMatthew Dillonutility appeared in 87*2b3f93eaSMatthew Dillon.Dx 6.5 88*2b3f93eaSMatthew Dillon.Sh AUTHORS 89*2b3f93eaSMatthew DillonThe 90*2b3f93eaSMatthew Dillon.Nm 91*2b3f93eaSMatthew Dillonutility was written by 92*2b3f93eaSMatthew DillonMatthew Dillon 93