Bug 212451

Summary: Add an --explain=cap_foo option to capsh
Product: Tools Reporter: Andrew G. Morgan (morgan)
Component: libcapAssignee: Andrew G. Morgan (morgan)
Status: RESOLVED CODE_FIX    
Severity: normal    
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: n/a Subsystem:
Regression: No Bisected commit-id:

Description Andrew G. Morgan 2021-03-26 19:41:13 UTC 
The documentation files contain the text explanations for each of the known capabilities. We should enhance capsh to use them explain what a capability is intended to enable. This is kind of like the --decode option we already support.

Idea:

  --explain=3 would output something like: 3=cap_fowner (0x016x) with the explanation from: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/tree/doc/values/3.txt

Since capsh would use cap_from_name(3) to interpret the capability, capsh will also be able to take --explain=cap_fowner as an argument.
Comment 1 Andrew G. Morgan 2021-03-26 19:50:09 UTC 
If the specific named capability is not supported by one or both of libcap and the running kernel, the output should indicate this with the attribute:

"reserved" = libcap knows a name, but the running kernel doesn't support it

"unsupported" = libcap and the running kernel do not support this value

"unnamed" = the kernel supports this, but libcap doesn't know its name
Comment 3 Andrew G. Morgan 2021-03-27 21:33:42 UTC 
Still need to update capsh man page.