diff options
Diffstat (limited to 'man7/capabilities.7')
| -rw-r--r-- | man7/capabilities.7 | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/man7/capabilities.7 b/man7/capabilities.7 index eae9f2fb13..fbe52e5f92 100644 --- a/man7/capabilities.7 +++ b/man7/capabilities.7 @@ -33,7 +33,7 @@ traditional Unix implementations distinguish two categories of processes: processes (whose effective user ID is 0, referred to as superuser or root), and .I unprivileged -processes (whose effective UID is non-zero). +processes (whose effective UID is nonzero). Privileged processes bypass all kernel permission checks, while unprivileged processes are subject to full permission checking based on the process's credentials @@ -467,14 +467,14 @@ a program, it gains all capabilities in its permitted and effective capability sets, except those masked out by the capability bounding set (i.e., .BR CAP_SETPCAP ). -.\" If a process with real UID 0, and non-zero effective UID does an +.\" If a process with real UID 0, and nonzero effective UID does an .\" exec(), then it gets all capabilities (less CAP_SETPCAP) in its .\" permitted set, and no effective capabilities This provides semantics that are the same as those provided by traditional Unix systems. .SS Effect of User ID Changes on Capabilities To preserve the traditional semantics for transitions between -0 and non-zero user IDs, +0 and nonzero user IDs, the kernel makes the following changes to a thread's capability sets on changes to the thread's real, effective, saved set, and file system user IDs (using @@ -484,17 +484,17 @@ or similar): .IP 1. 4 If one or more of the real, effective or saved set user IDs was previously 0, and as a result of the UID changes all of these IDs -have a non-zero value, +have a nonzero value, then all capabilities are cleared from the permitted and effective capability sets. .IP 2. 4 -If the effective user ID is changed from 0 to non-zero, +If the effective user ID is changed from 0 to nonzero, then all capabilities are cleared from the effective set. .IP 3. 4 -If the effective user ID is changed from non-zero to 0, +If the effective user ID is changed from nonzero to 0, then the permitted set is copied to the effective set. .IP 4. 4 -If the file system user ID is changed from 0 to non-zero (see +If the file system user ID is changed from 0 to nonzero (see .BR setfsuid (2)) then the following capabilities are cleared from the effective set: .BR CAP_CHOWN , @@ -503,13 +503,13 @@ then the following capabilities are cleared from the effective set: .BR CAP_FOWNER , and .BR CAP_FSETID . -If the file system UID is changed from non-zero to 0, +If the file system UID is changed from nonzero to 0, then any of these capabilities that are enabled in the permitted set are enabled in the effective set. .PP If a thread that has a 0 value for one or more of its user IDs wants to prevent its permitted capability set being cleared when it resets -all of its user IDs to non-zero values, it can do so using the +all of its user IDs to nonzero values, it can do so using the .BR prctl (2) .B PR_SET_KEEPCAPS operation. |