amend gitignore

2026-07-23 15:23:47 +08:00
parent 6f34caf845
commit 3d62194fec
19 changed files with 875 additions and 597 deletions
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include <sys/capability.h>
+#include <sys/prctl.h>
+#include <linux/capability.h>
+#include "capabilities.h"
+
+int capabilities(void)
+{
+	fprintf(stderr, "=> dropping capabilities...");
+	int drop_caps[] = {
+		CAP_AUDIT_CONTROL,
+		CAP_AUDIT_READ,
+		CAP_AUDIT_WRITE,
+		CAP_BLOCK_SUSPEND,
+		CAP_DAC_READ_SEARCH,
+		CAP_FSETID,
+		CAP_IPC_LOCK,
+		CAP_MAC_ADMIN,
+		CAP_MAC_OVERRIDE,
+		CAP_MKNOD,
+		CAP_SETFCAP,
+		CAP_SYSLOG,
+		CAP_SYS_ADMIN,
+		CAP_SYS_BOOT,
+		CAP_SYS_MODULE,
+		CAP_SYS_NICE,
+		CAP_SYS_RAWIO,
+		CAP_SYS_RESOURCE,
+		CAP_SYS_TIME,
+		CAP_WAKE_ALARM
+	};
+	size_t num_caps = sizeof(drop_caps) / sizeof(*drop_caps);
+	fprintf(stderr, "bounding...");
+	for (size_t i = 0; i < num_caps; i++) {
+		if (prctl(PR_CAPBSET_DROP, drop_caps[i], 0, 0, 0)) {
+			fprintf(stderr, "prctl failed: %m\n");
+			return 1;
+		}
+	}
+	fprintf(stderr, "inheritable...");
+	cap_t caps = NULL;
+	if (!(caps = cap_get_proc())
+	    || cap_set_flag(caps, CAP_INHERITABLE, num_caps, drop_caps, CAP_CLEAR)
+	    || cap_set_proc(caps)) {
+		fprintf(stderr, "failed: %m\n");
+		if (caps) cap_free(caps);
+		return 1;
+	}
+	cap_free(caps);
+	fprintf(stderr, "done.\n");
+	return 0;
+}