[B! capability] udzuraã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

udzura id:udzura

capabilityã«é–¢ã™ã‚‹udzuraã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

æ˜Žæ—¥ä½¿ãˆãªã„ Linux ã® capabilities ã®è©± - @nojima's blog
(ã“ã®è¨˜äº‹ã¯ KMC ã‚¢ãƒ‰ãƒ™ãƒ³ãƒˆã‚«ãƒ¬ãƒ³ãƒ€ãƒ¼ 2016 ã®3æ—¥ç›®ã®è¨˜äº‹ã§ã™) ã¯ã˜ã‚ã« ã¿ãªã•ã‚“ä»¥ä¸‹ã®ã‚ˆã†ãªã“ã¨ã§å›°ã£ãŸã“ã¨ã¯ãªã„ã§ã—ã‚‡ã†ã‹ï¼Ÿ ãƒãƒ¼ãƒˆ80ã‚’ listen ã—ãŸã„ã‘ã©ç‰¹æ¨©ãƒãƒ¼ãƒˆãªã®ã§ã€ä¸€èˆ¬ãƒ¦ãƒ¼ã‚¶ã®æ¨©é™ã§å‹•ããƒ‡ãƒ¼ãƒ¢ãƒ³ã§ã¯ bind ã§ããªã„ã€‚ 1024æœªæº€ã®ãƒãƒ¼ãƒˆã¯ç‰¹æ¨©ãƒãƒ¼ãƒˆã¨å‘¼ã°ã‚Œã€ä¸€èˆ¬ãƒ¦ãƒ¼ã‚¶ã®æ¨©é™ã§ã¯ bind ã™ã‚‹ã“ã¨ã¯ã§ãã¾ã›ã‚“ã€‚ ã“ã®å•é¡Œã®è§£æ±ºç–ã‚’è€ƒãˆã¦ã¿ã¾ã™ã€‚ ï¼ˆãªãŠã€é•·ã€…ã¨èª¬æ˜Žã‚’æ›¸ã„ã¦ã„ã¾ã™ãŒã€çµè«–ã ã‘çŸ¥ã‚ŠãŸã„äººã¯ä¸€ç•ªä¸‹ã ã‘èªã‚“ã§ä¸‹ã•ã„ï¼‰ root ã§èµ·å‹• ã¾ãšã€root ã§ã‚ã‚Œã°ç‰¹æ¨©ãƒãƒ¼ãƒˆã‚’è‡ªç”±ã« bind ã§ãã‚‹ã®ã§ã€root ã§å¯¾è±¡ãƒ‡ãƒ¼ãƒ¢ãƒ³ã‚’èµ·å‹•ã™ã‚Œã°ã€ç‰¹æ¨©ãƒãƒ¼ãƒˆã‚’ bind ã§ãã¾ã™ã€‚ ã—ã‹ã—ã€ãƒ‡ãƒ¼ãƒ¢ãƒ³ã‚’ root ã¨ã—ã¦å‹•ä½œã•ã›ã‚‹ã®ã¯ä¸€èˆ¬ã«ãƒªã‚¹ã‚¯ãŒå¤§ãã„ã§ã™ã€‚ ã‚‚ã—ãã®ãƒ‡ãƒ¼ãƒ¢ãƒ³ã«è„†å¼±æ€§ãŒã‚ã£ãŸå ´åˆã€root æ¨©é™ã‚’æ‚ªç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã‚ã‘ã§ã™ã€‚ ã—ãŸãŒ
udzura 2016/12/03
CentOS7(ã‚«ãƒ¼ãƒãƒ«3.10)ã§capabilityã§éŠã‚“ã§ã„ãŸã®ã§ã€ambient capabilityã®å˜åœ¨ã‚’çŸ¥ã£ãŸæ™‚ã¯ç›®ã‹ã‚‰é±—ãŒâ€¦

capability

linux
ãƒªãƒ³ã‚¯
æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æŠ€è¡“å‹•å‘èª¿æŸ»ï¼ˆ2011 å¹´ä¸‹æœŸï¼‰ï¼šIPA ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
FreeBSD9.0ã‹ã‚‰ã¯ã€æ–°ãŸãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ©Ÿæ§‹ã¨ã—ã¦ã‚±ãƒ¼ãƒ‘ãƒ“ãƒªãƒ†ã‚£ã‚’åˆ©ç”¨ã™ã‚‹capsicumãŒå®Ÿè£…ã•ã‚ŒãŸã€‚ã“ã“ã§ã¯ã€ä¸€èˆ¬çš„ãªã‚±ãƒ¼ãƒ‘ãƒ“ãƒªãƒ†ã‚£ã¨ã€capsicumã®ä½¿ç”¨æ–¹æ³•ã‚’èª¬æ˜Žã™ã‚‹ã€‚ é€šå¸¸Unixã§ã¯ã€ãƒ—ãƒã‚»ã‚¹ã¯ä¸€èˆ¬ãƒ¦ãƒ¼ã‚¶ã®æ¨©é™ã§å‹•ãã‹ã€ç‰¹æ¨©ï¼ˆrootæ¨©é™ï¼‰ã§å‹•ãã‹ã®2ç¨®é¡žã¨ãªã‚‹ã€‚ãŸã¨ãˆã°ã€Apacheãªã©ã®ã‚µãƒ¼ãƒ“ã‚¹ãŒ1024ç•ªæœªæº€ã®ã„ã‚ã‚†ã‚‹ã€Œç‰¹æ¨©ãƒãƒ¼ãƒˆã€ã‚’ãƒ—ãƒã‚»ã‚¹ã§ä½¿ç”¨ã™ã‚‹éš›ã‚„ã€pingã‚„snortãªã©ã®ã‚ˆã†ã«ç”Ÿï¼ˆrawï¼‰ã‚½ã‚±ãƒƒãƒˆã‚’ã‚¤ãƒ¼ã‚µãƒãƒƒãƒˆãƒ‡ãƒã‚¤ã‚¹ã«å¯¾ã—ã¦ã‚ªãƒ¼ãƒ—ãƒ³ã—ã€ç”Ÿã®IPãƒ‡ãƒ¼ã‚¿ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’è¦‹ã‚‹æ™‚ã€ã‚ã‚‹ã„ã¯ntpdãªã©ã§ã‚·ã‚¹ãƒ†ãƒ ã®æ™‚åˆ»ã‚’è¨å®šã™ã‚‹éš›ã«ã¯ã€ãƒ—ãƒã‚»ã‚¹ã«ç‰¹æ¨©ãŒå¿…è¦ã«ãªã‚‹ã€‚ ã—ã‹ã—ã€ãƒ—ãƒã‚»ã‚¹ã«ç‰¹æ¨©ã‚’ã™ã¹ã¦ä¸Žãˆã¦ã—ã¾ã†ã¨ã€å‹•ä½œã—ã¦ã„ã‚‹ãƒ—ãƒã‚»ã‚¹ã«è„†å¼±æ€§ãŒã‚ã£ãŸå ´åˆã«ã€ä¸æ£ãªæ“ä½œã§ã™ã¹ã¦ã®ç‰¹æ¨©ãŒå–ã‚‰ã‚Œã¦ã—ã¾ã†å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚ ã“ã®å•é¡Œã¯éšåˆ†å‰ã‹ã‚‰æŒ‡æ‘˜ã•ã‚Œã¦ãŠã‚Šã€ã“ã‚Œã‚’è§£æ±ºã™ã‚‹æ–¹æ³•
udzura 2016/08/25
capability

security
ãƒªãƒ³ã‚¯
haconiwaã®å®¤å†…æ¥½ - Re: è‡ªä½œLinuxã‚³ãƒ³ãƒ†ãƒŠã®æ™‚ä»£ - ãƒãƒ¼ãƒ•ã‚¡ã‚¤æ—¥è¨˜
haconiwa ã¨ã„ã†ã€ã„ã‚ã‚†ã‚‹Linuxã‚³ãƒ³ãƒ†ãƒŠã«é–¢ã™ã‚‹æ§˜ã€…ãªæŠ€è¡“ã‚’çµ„ã¿åˆã‚ã›ã¦ã€è‡ªåˆ†ã®ãŸã‚ã®ã‚³ãƒ³ãƒ†ãƒŠã‚’ä½œã‚‹ã“ã¨ãŒã§ãã‚‹Rubyè£½ã®ãƒ„ãƒ¼ãƒ«ã¨ã€ãã®DSLã‚’ä½œã£ãŸã€‚ã²ã¨ã¾ãšã“ã‚Œãã‚‰ã„ã¯ã‚„ã‚ŠãŸã„ã¨ã„ã†ã“ã¨ãŒã§ãã¦ã„ãã†ãªã®ã§ã€ãƒãƒ¼ã‚¸ãƒ§ãƒ³ 0.2.0 ã¨ã—ã¦ãƒªãƒªãƒ¼ã‚¹ã—ãŸã€‚ github.com ä½¿ã„æ–¹ ã»ã¼READMEã®æ—¥æœ¬èªžç‰ˆã€‚ å‰æã¨ã—ã¦ã€ä»¥ä¸‹ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã¨ã‚³ãƒžãƒ³ãƒ‰ãŒå¿…è¦ã«ãªã‚‹ã®ã§å…¥ã‚Œã¦ãŠã„ã¦æ¬²ã—ã„ã€‚ libcap (libcap.so.2 ã‚’ FFI çµŒç”±ã§ä½¿ã†) nsenter (yum install util-linux ã¨ã‹ãã†ã„ã†æ„Ÿã˜ã§å…¥ã‚Œã‚‹) ã²ã¨ã¾ãšå‹•ã‹ã—ãŸã„å ´åˆã¯ã€rbenvãªã©ãŒæ•´ã£ãŸç’°å¢ƒã§ã€gemã¨ã—ã¦å…¥ã‚Œã‚‹ã®ãŒã„ã„ã¨æ€ã†ã€‚å¤šåˆ†Ruby 2.0 ä»¥é™ã§å‹•ãæ°—ãŒã™ã‚‹ã€‚ $ gem install haconiwa $ rbenv rehash ãã—ã¦ã€ç¾åœ¨ã®hacon
udzura 2016/06/03
æ–°èœã®ç´¹ä»‹ã§ã™

container

cgroup

capability

namespace

ruby
ãƒªãƒ³ã‚¯
Man page of CAPABILITIES
Section: Linux Programmer's Manual (7) Updated: 2015-02-01 Index JM Home Page roff page åå‰ capabilities - Linux ã®ã‚±ãƒ¼ãƒ‘ãƒ“ãƒªãƒ†ã‚£ (capability) ã®æ¦‚è¦ èª¬æ˜Ž æ¨©é™ã®ãƒã‚§ãƒƒã‚¯ã‚’è¡Œã†è¦³ç‚¹ã‹ã‚‰è¦‹ã‚‹ã¨ã€ä¼çµ±çš„ãª UNIX ã®å®Ÿè£…ã§ã¯ ãƒ—ãƒã‚»ã‚¹ã¯äºŒã¤ã®ã‚«ãƒ†ã‚´ãƒªãƒ¼ã«åˆ†é¡žã§ãã‚‹: ç‰¹æ¨© ãƒ—ãƒã‚»ã‚¹ (å®ŸåŠ¹ãƒ¦ãƒ¼ã‚¶ãƒ¼ID ãŒ 0 ã®ãƒ—ãƒã‚»ã‚¹ã€‚ãƒ¦ãƒ¼ã‚¶ãƒ¼ID 0 ã¯ ã‚¹ãƒ¼ãƒ‘ãƒ¼ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚„ root ã¨å‘¼ã°ã‚Œã‚‹) ã¨ éžç‰¹æ¨© ãƒ—ãƒã‚»ã‚¹ (å®ŸåŠ¹ãƒ¦ãƒ¼ã‚¶ãƒ¼ID ãŒ 0 ä»¥å¤–ã®ãƒ—ãƒã‚»ã‚¹) ã§ã‚ã‚‹ã€‚ éžç‰¹æ¨©ãƒ—ãƒã‚»ã‚¹ã§ã¯ã€ãƒ—ãƒã‚»ã‚¹ã®è³‡æ ¼æƒ…å ± (é€šå¸¸ã¯ã€å®ŸåŠ¹UID ã€å®ŸåŠ¹GID ã¨è¿½åŠ ã®ã‚°ãƒ«ãƒ¼ãƒ—ãƒªã‚¹ãƒˆ) ã«åŸºã¥ãæ¨©é™ãƒã‚§ãƒƒã‚¯ãŒè¡Œã‚ã‚Œã‚‹ã®ã«å¯¾ã—ã€ ç‰¹æ¨©ãƒ—ãƒã‚»ã‚¹ã§ã¯å…¨ã¦ã®ã‚«ãƒ¼ãƒãƒ«ã®æ¨©é™ãƒã‚§ãƒƒã‚¯ãŒãƒã‚¤ãƒ‘ã‚¹ã•ã‚Œã‚‹ã€‚
udzura 2016/05/31
linux

capability
ãƒªãƒ³ã‚¯
Man page of PRCTL
udzura 2016/05/31
linux

capability
ãƒªãƒ³ã‚¯
IBM Developer
IBM Developer is your one-stop location for getting hands-on training and learning in-demand skills on relevant techno logies such as generative AI, data science, AI, and open source.
udzura 2016/04/30
capability

linux
ãƒªãƒ³ã‚¯
[linux] /sbin/capsh - hibomaã®æ—¥è¨˜
ã‚±ãƒ¼ãƒ‘ãƒ“ãƒªãƒ†ã‚£ã‚’ç¢ºèªã—ãŸã‚Š root@ubuntu: # capsh --print Current: =ep Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sy
udzura 2014/10/21
ä¾¿åˆ©ãƒ„ãƒ¼ãƒ«æƒ…å ±ã‚’æ•™ã‚ã£ãŸ

linux

capability
ãƒªãƒ³ã‚¯
1