daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
a19bc6
From 734c3a184c3b196412e15e4db1b7419f13b901b4 Mon Sep 17 00:00:00 2001
a19bc6
From: Ismo Puustinen <ismo.puustinen@intel.com>
a19bc6
Date: Mon, 11 Jan 2016 09:36:14 +0200
a19bc6
Subject: [PATCH] man: add AmbientCapabilities entry.
a19bc6
a19bc6
Cherry-picked from: ece8797
a19bc6
Resolves: #1387398
a19bc6
---
a19bc6
 man/systemd.exec.xml | 29 +++++++++++++++++++++++++++++
a19bc6
 1 file changed, 29 insertions(+)
a19bc6
a19bc6
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
181b3f
index aa5831cc2..1b14ced78 100644
a19bc6
--- a/man/systemd.exec.xml
a19bc6
+++ b/man/systemd.exec.xml
181b3f
@@ -766,6 +766,35 @@
181b3f
         settings.</para></listitem>
a19bc6
       </varlistentry>
a19bc6
 
181b3f
+      <varlistentry>
a19bc6
+        <term><varname>AmbientCapabilities=</varname></term>
a19bc6
+
a19bc6
+        <listitem><para>Controls which capabilities to include in the
a19bc6
+        ambient capability set for the executed process. Takes a
a19bc6
+        whitespace-separated list of capability names as read by
a19bc6
+        <citerefentry project='mankier'><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
a19bc6
+        e.g. <constant>CAP_SYS_ADMIN</constant>,
a19bc6
+        <constant>CAP_DAC_OVERRIDE</constant>,
a19bc6
+        <constant>CAP_SYS_PTRACE</constant>. This option may appear more than
a19bc6
+        once in which case the ambient capability sets are merged.
a19bc6
+        If the list of capabilities is prefixed with <literal>~</literal>, all
a19bc6
+        but the listed capabilities will be included, the effect of the
a19bc6
+        assignment inverted. If the empty string is
a19bc6
+        assigned to this option, the ambient capability set is reset to
a19bc6
+        the empty capability set, and all prior settings have no effect.
a19bc6
+        If set to <literal>~</literal> (without any further argument), the
a19bc6
+        ambient capability set is reset to the full set of available
a19bc6
+        capabilities, also undoing any previous settings. Note that adding
a19bc6
+        capabilities to ambient capability set adds them to the process's
a19bc6
+        inherited capability set.
a19bc6
+        </para><para>
a19bc6
+        Ambient capability sets are useful if you want to execute a process
a19bc6
+        as a non-privileged user but still want to give it some capabilities.
a19bc6
+        Note that in this case option <constant>keep-caps</constant> is
a19bc6
+        automatically added to <varname>SecureBits=</varname> to retain the
a19bc6
+        capabilities over the user change.</para></listitem>
a19bc6
+      </varlistentry>
a19bc6
+
181b3f
       <varlistentry>
a19bc6
         <term><varname>SecureBits=</varname></term>
a19bc6
         <listitem><para>Controls the secure bits set for the executed