Setting POSIX Capabilities
==========================

`POSIX capabilities`_ allow fine-grained permissions for processes. In addition
to the standard UNIX permission scheme, they define a new set of privileges for
system resources.  To enable capabilities support (Linux Only) you have to
install the ``libcap`` headers (``libcap-dev`` on Debian-based distros) before
building uWSGI.  As usual your processes will lose practically all of the
capabilities after a ``setuid`` call. The uWSGI ``cap`` option allows you to
define a list of capabilities to maintain through the call.  

For example, to allow your unprivileged app to bind on privileged ports and set
the system clock, you will use the following options.

.. code-block:: sh

  uwsgi --socket :1000 --uid 5000 --gid 5000 --cap net_bind_service,sys_time

All of the processes generated by uWSGI will then inherit this behaviour.  If
your system supports capabilities not available in the uWSGI list you can
simply specify the number of the constant:

.. code-block:: sh

  uwsgi --socket :1000 --uid 5000 --gid 5000 --cap net_bind_service,sys_time,42

In addition to ``net_bind_service`` and ``sys_time``, a new capability numbered '42' is added.

.. _POSIX capabilities: http://en.wikipedia.org/wiki/Capability-based_security

Available capabilities
----------------------


This is the list of available capabilities.

==================  ======================
audit_control       CAP_AUDIT_CONTROL
audit_write         CAP_AUDIT_WRITE
chown               CAP_CHOWN
dac_override        CAP_DAC_OVERRIDE
dac_read_search     CAP_DAC_READ_SEARCH
fowner              CAP_FOWNER
fsetid              CAP_FSETID
ipc_lock            CAP_IPC_LOCK
ipc_owner           CAP_IPC_OWNER
kill                CAP_KILL
lease               CAP_LEASE
linux_immutable     CAP_LINUX_IMMUTABLE
mac_admin           CAP_MAC_ADMIN
mac_override        CAP_MAC_OVERRIDE
mknod               CAP_MKNOD
net_admin           CAP_NET_ADMIN
net_bind_service    CAP_NET_BIND_SERVICE
net_broadcast       CAP_NET_BROADCAST
net_raw             CAP_NET_RAW
setfcap             CAP_SETFCAP
setgid              CAP_SETGID
setpcap             CAP_SETPCAP
setuid              CAP_SETUID
sys_admin           CAP_SYS_ADMIN
sys_boot            CAP_SYS_BOOT
sys_chroot          CAP_SYS_CHROOT
sys_module          CAP_SYS_MODULE
sys_nice            CAP_SYS_NICE
sys_pacct           CAP_SYS_PACCT
sys_ptrace          CAP_SYS_PTRACE
sys_rawio           CAP_SYS_RAWIO
sys_resource        CAP_SYS_RESOURCE
sys_time            CAP_SYS_TIME
sys_tty_config      CAP_SYS_TTY_CONFIG
syslog              CAP_SYSLOG
wake_alarm          CAP_WAKE_ALARM
==================  ======================
