[lkml]   [2021]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[RFC PATCH v1 0/2] Add capabilities file to sysfs

First, I hope you are fine and the same for your relatives.

Capabilities are used to check if a thread has the right to perform a given
action [1].
For example, a thread with CAP_BPF set can use the bpf() syscall.

Capabilities are used in the container world.
In terms of code, several projects related to container maintain code where the
capabilities are written alike include/uapi/linux/capability.h [2][3][4][5].
For these projects, their codebase should be updated when a new capability is
added to the kernel.
Some other projects rely on <sys/capability.h> [6].
In this case, this header file should reflect the capabilities offered by the

So, in this series, I added a new file to sysfs: /sys/kernel/capabilities.
The goal of this file is to be used by "container world" software to know kernel
capabilities at run time instead of compile time.

The underlying kernel attribute is read-only and its content is the capability
number associated with the capability name:
root@vm-amd64:~# cat /sys/kernel/capabilities

The kernel already exposes the last capability number under:
So, I think there should not be any issue exposing all the capabilities it
If there is any, please share it as I do not want to introduce issue with this

Also, if you see any way to improve this series please share it as it would
increase this contribution quality.

Francis Laniel (2):
capability: Add cap_strings.
kernel/ksysfs.c: Add capabilities attribute.

include/uapi/linux/capability.h | 1 +
kernel/capability.c | 45 +++++++++++++++++++++++++++++++++
kernel/ksysfs.c | 18 +++++++++++++
3 files changed, 64 insertions(+)

Best regards and thank you in advance for your reviews.
[1] man capabilities
moby relies on containerd code.
runc relies on syndtr package.


 \ /
  Last update: 2021-12-27 21:57    [W:2.435 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site