capset capget 设置和获得进程权限

来源：互联网发布：java按键监听器编辑：程序博客网时间：2024/05/22 10:33

capset 和capget 分别用来设置和获取进程权限：

int capget(cap_user_header_t hdrp, cap_user_data_t datap);

int capset(cap_user_header_t hdrp, const cap_user_data_t datap);

相关的宏和数据结构

           #define _LINUX_CAPABILITY_VERSION_1  0x19980330           #define _LINUX_CAPABILITY_U32S_1     1           #define _LINUX_CAPABILITY_VERSION_2  0x20071026           #define _LINUX_CAPABILITY_U32S_2     2           typedef struct __user_cap_header_struct {              __u32 version;              int pid;           } *cap_user_header_t;           typedef struct __user_cap_data_struct {              __u32 effective;              __u32 permitted;              __u32 inheritable;           } *cap_user_data_t；

例子：

#undef _POSIX_SOURCE#include <stdlib.h>#include <stdio.h>#include <sys/types.h>#include <unistd.h>#include <sys/capability.h>#include <errno.h>int main(){    struct __user_cap_header_struct cap_header;    struct __user_cap_data_struct   cap_data;    cap_header.pid = getpid() ;    cap_header.version = _LINUX_CAPABILITY_VERSION_1;    if( capget(&cap_header, &cap_data) < 0)    {        printf("%s\n", strerror(errno));        exit(EXIT_FAILURE);    }    printf("capheader: %x  %d\n", cap_header.version, cap_header.pid);    printf("capdata: %x  %x  %x\n", cap_data.effective, cap_data.permitted, cap_data.inheritable);    __u32 cap_mask  = 0;    cap_mask |= (1 << CAP_NET_BIND_SERVICE);    cap_data.effective = cap_mask;//类似于权限的集合    cap_data.permitted = cap_mask;//0001000000    cap_data.inheritable = 0;//子进程不继承特权    if( capset(&cap_header, &cap_data) < 0)    {        printf("%s\n", strerror(errno));        exit(EXIT_FAILURE);    }    printf("%d\n", capget(&cap_header, &cap_data));    printf("capheader: %x  %d\n", cap_header.version, cap_header.pid);    printf("capdata: %x  %x  %x\n", cap_data.effective, cap_data.permitted, cap_data.inheritable);    return 0;}

---》必须以root权限或者sudo才能执行:

普通用户：

capheader: 19980330 6092
capdata: 0 0 0
Operation not permitted

root:

capheader: 19980330 6098
capdata: ffffffff ffffffff 0
0
capheader: 19980330 6098
capdata: 400 400 0

1 0