kernel: glibc: prctl
@[TOC
参考
https://man7.org/linux/man-pages/man2/prctl.2.html
简介
#include <sys/prctl.h>
int prctl(int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5);
最终调用的是内核的
kernel/sys.c:SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
PR_CAP_AMBIENT_RAISE
使用时需要注意的问题;
如果是非root用户执行的程序需要特殊的权限才能执行。kernel代码会从下面多个设置选项做检查。
如果碰到EPERM错误
if (arg2 == PR_CAP_AMBIENT_RAISE &&
(!cap_raised(current_cred()->cap_permitted, arg3) || //看允许集里是否有
!cap_raised(current_cred()->cap_inheritable, //看继承集里是否有
arg3) ||
issecure(SECURE_NO_CAP_AMBIENT_RAISE))) // 看对应的安全位是否被disable
return -EPERM;
SECURE_NO_CAP_AMBIENT_RAISE
commit 746bf6d64275be0c65b0631d8a72b16f1454cfa1
Author: Andy Lutomirski luto@kernel.org
Date: Fri Sep 4 15:42:51 2015 -0700
capabilities: add a securebit to disable PR_CAP_AMBIENT_RAISE
Per Andrew Morgan's request, add a securebit to allow admins to disable
PR_CAP_AMBIENT_RAISE. This securebit will prevent processes from adding
capabilities to their ambient set.
For simplicity, this disables PR_CAP_AMBIENT_RAISE entirely rather than
just disabling setting previously cleared bits.
注意事项
需要注意的是,如果需要设置多个能力,需要单个执行不能合并执行。
if(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_RAW,0, 0)!=0)
if(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_ADMIN, 0, 0)!=0)
if(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_RAW|CAP_NET_ADMIN,0, 0)!=0) ;; 这个执行会有问题。
prctl 相关的单元测试
tools/testing/selftests/syscall_user_dispatch/sud_test.c
相关文章
- [Kernel]内核版本添加字符和内核版本'+'解决
- 如何处理VirtualBox启动错误消息:The vboxdrv kernel module is not loaded
- Rockchip RK3588 kernel dts解析之音频模块
- Linux Kernel Printk输出kernel打印
- 成功解决AttributeError: 'BasicLSTMCell' object has no attribute '_kernel'+python下划线用法的几种常见用法理解
- (DT系列五)Linux kernel 是怎么将 devicetree中的内容生成plateform_device
- debian 升级内核 以及 修改 kernel 的 开机启动 顺序
- WSL2构建android10+kernel源码适配pixel
- Android修改kernel logo和开机动画(android)
- Android培训班(112)start_kernel函数9
- Kernel: text段为什么前面是两个点,LD_DEAD_CODE_DATA_ELIMINATION, ffunction-sections
- RuntimeError: “softmax_lastdim_kernel_impl“ not implemented for ‘Long‘
- TatukGIS Developer Kernel for Net Crack
- 按电源键屏幕唤醒和屏幕睡眠流程(从上层到kernel)
- 嵌入式Linux,4G模组驱动,移远EC20、EC25使用随笔-内核kernel
- Docker编译linux kernel