jail: capabilities: apply in two phases

[project/procd.git] / jail / capabilities.h

diff --git a/jail/capabilities.h b/jail/capabilities.h
index 11b8cc27e9d54b0cbc0e89e34153a8e97c031ee4..d8c6b8d60b56e5285b54df2c45a2de9f9e87d1d9 100644 (file)
--- a/jail/capabilities.h
+++ b/jail/capabilities.h
@@ -13,6 +13,24 @@
 #ifndef _JAIL_CAPABILITIES_H_
 #define _JAIL_CAPABILITIES_H_
 
-int drop_capabilities(const char *file);
+#include <libubox/blobmsg.h>
+#include <linux/capability.h>
+
+struct jail_capset {
+       uint64_t bounding;
+       uint64_t effective;
+       uint64_t inheritable;
+       uint64_t permitted;
+       uint64_t ambient;
+       uint8_t apply;
+};
+
+int parseOCIcapabilities(struct jail_capset *capset, struct blob_attr *msg);
+int parseOCIcapabilities_from_file(struct jail_capset *capset, const char *file);
+int applyOCIcapabilities(struct jail_capset capset, uint64_t retain);
+
+/* capget/capset syscall wrappers are provided by libc */
+extern int capget(cap_user_header_t header, cap_user_data_t data);
+extern int capset(cap_user_header_t header, const cap_user_data_t data);
 
 #endif