linux-capabilities (empty) → 0.1.0.0

raw patch · 6 files changed

+539/−0 lines, 6 filesdep +base

Dependencies added: base

Files

• CHANGELOG.md +9/−0
• LICENSE +201/−0
• README.md +8/−0
• codegen.hs +70/−0
• linux-capabilities.cabal +46/−0
• src/System/Linux/Capabilities.hs +205/−0

@@ -0,0 +1,9 @@+# Changelog++`linux-capabilities` uses [PVP Versioning][1].++## 0.1.0.0++* Initially created.++[1]: https://pvp.haskell.org

@@ -0,0 +1,201 @@+                                 Apache License+                           Version 2.0, January 2004+                        http://www.apache.org/licenses/++   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION++   1. Definitions.++      "License" shall mean the terms and conditions for use, reproduction,+      and distribution as defined by Sections 1 through 9 of this document.++      "Licensor" shall mean the copyright owner or entity authorized by+      the copyright owner that is granting the License.++      "Legal Entity" shall mean the union of the acting entity and all+      other entities that control, are controlled by, or are under common+      control with that entity. For the purposes of this definition,+      "control" means (i) the power, direct or indirect, to cause the+      direction or management of such entity, whether by contract or+      otherwise, or (ii) ownership of fifty percent (50%) or more of the+      outstanding shares, or (iii) beneficial ownership of such entity.++      "You" (or "Your") shall mean an individual or Legal Entity+      exercising permissions granted by this License.++      "Source" form shall mean the preferred form for making modifications,+      including but not limited to software source code, documentation+      source, and configuration files.++      "Object" form shall mean any form resulting from mechanical+      transformation or translation of a Source form, including but+      not limited to compiled object code, generated documentation,+      and conversions to other media types.++      "Work" shall mean the work of authorship, whether in Source or+      Object form, made available under the License, as indicated by a+      copyright notice that is included in or attached to the work+      (an example is provided in the Appendix below).++      "Derivative Works" shall mean any work, whether in Source or Object+      form, that is based on (or derived from) the Work and for which the+      editorial revisions, annotations, elaborations, or other modifications+      represent, as a whole, an original work of authorship. For the purposes+      of this License, Derivative Works shall not include works that remain+      separable from, or merely link (or bind by name) to the interfaces of,+      the Work and Derivative Works thereof.++      "Contribution" shall mean any work of authorship, including+      the original version of the Work and any modifications or additions+      to that Work or Derivative Works thereof, that is intentionally+      submitted to Licensor for inclusion in the Work by the copyright owner+      or by an individual or Legal Entity authorized to submit on behalf of+      the copyright owner. For the purposes of this definition, "submitted"+      means any form of electronic, verbal, or written communication sent+      to the Licensor or its representatives, including but not limited to+      communication on electronic mailing lists, source code control systems,+      and issue tracking systems that are managed by, or on behalf of, the+      Licensor for the purpose of discussing and improving the Work, but+      excluding communication that is conspicuously marked or otherwise+      designated in writing by the copyright owner as "Not a Contribution."++      "Contributor" shall mean Licensor and any individual or Legal Entity+      on behalf of whom a Contribution has been received by Licensor and+      subsequently incorporated within the Work.++   2. Grant of Copyright License. Subject to the terms and conditions of+      this License, each Contributor hereby grants to You a perpetual,+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable+      copyright license to reproduce, prepare Derivative Works of,+      publicly display, publicly perform, sublicense, and distribute the+      Work and such Derivative Works in Source or Object form.++   3. Grant of Patent License. Subject to the terms and conditions of+      this License, each Contributor hereby grants to You a perpetual,+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable+      (except as stated in this section) patent license to make, have made,+      use, offer to sell, sell, import, and otherwise transfer the Work,+      where such license applies only to those patent claims licensable+      by such Contributor that are necessarily infringed by their+      Contribution(s) alone or by combination of their Contribution(s)+      with the Work to which such Contribution(s) was submitted. If You+      institute patent litigation against any entity (including a+      cross-claim or counterclaim in a lawsuit) alleging that the Work+      or a Contribution incorporated within the Work constitutes direct+      or contributory patent infringement, then any patent licenses+      granted to You under this License for that Work shall terminate+      as of the date such litigation is filed.++   4. Redistribution. You may reproduce and distribute copies of the+      Work or Derivative Works thereof in any medium, with or without+      modifications, and in Source or Object form, provided that You+      meet the following conditions:++      (a) You must give any other recipients of the Work or+          Derivative Works a copy of this License; and++      (b) You must cause any modified files to carry prominent notices+          stating that You changed the files; and++      (c) You must retain, in the Source form of any Derivative Works+          that You distribute, all copyright, patent, trademark, and+          attribution notices from the Source form of the Work,+          excluding those notices that do not pertain to any part of+          the Derivative Works; and++      (d) If the Work includes a "NOTICE" text file as part of its+          distribution, then any Derivative Works that You distribute must+          include a readable copy of the attribution notices contained+          within such NOTICE file, excluding those notices that do not+          pertain to any part of the Derivative Works, in at least one+          of the following places: within a NOTICE text file distributed+          as part of the Derivative Works; within the Source form or+          documentation, if provided along with the Derivative Works; or,+          within a display generated by the Derivative Works, if and+          wherever such third-party notices normally appear. The contents+          of the NOTICE file are for informational purposes only and+          do not modify the License. You may add Your own attribution+          notices within Derivative Works that You distribute, alongside+          or as an addendum to the NOTICE text from the Work, provided+          that such additional attribution notices cannot be construed+          as modifying the License.++      You may add Your own copyright statement to Your modifications and+      may provide additional or different license terms and conditions+      for use, reproduction, or distribution of Your modifications, or+      for any such Derivative Works as a whole, provided Your use,+      reproduction, and distribution of the Work otherwise complies with+      the conditions stated in this License.++   5. Submission of Contributions. Unless You explicitly state otherwise,+      any Contribution intentionally submitted for inclusion in the Work+      by You to the Licensor shall be under the terms and conditions of+      this License, without any additional terms or conditions.+      Notwithstanding the above, nothing herein shall supersede or modify+      the terms of any separate license agreement you may have executed+      with Licensor regarding such Contributions.++   6. Trademarks. This License does not grant permission to use the trade+      names, trademarks, service marks, or product names of the Licensor,+      except as required for reasonable and customary use in describing the+      origin of the Work and reproducing the content of the NOTICE file.++   7. Disclaimer of Warranty. Unless required by applicable law or+      agreed to in writing, Licensor provides the Work (and each+      Contributor provides its Contributions) on an "AS IS" BASIS,+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or+      implied, including, without limitation, any warranties or conditions+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A+      PARTICULAR PURPOSE. You are solely responsible for determining the+      appropriateness of using or redistributing the Work and assume any+      risks associated with Your exercise of permissions under this License.++   8. Limitation of Liability. In no event and under no legal theory,+      whether in tort (including negligence), contract, or otherwise,+      unless required by applicable law (such as deliberate and grossly+      negligent acts) or agreed to in writing, shall any Contributor be+      liable to You for damages, including any direct, indirect, special,+      incidental, or consequential damages of any character arising as a+      result of this License or out of the use or inability to use the+      Work (including but not limited to damages for loss of goodwill,+      work stoppage, computer failure or malfunction, or any and all+      other commercial damages or losses), even if such Contributor+      has been advised of the possibility of such damages.++   9. Accepting Warranty or Additional Liability. While redistributing+      the Work or Derivative Works thereof, You may choose to offer,+      and charge a fee for, acceptance of support, warranty, indemnity,+      or other liability obligations and/or rights consistent with this+      License. However, in accepting such obligations, You may act only+      on Your own behalf and on Your sole responsibility, not on behalf+      of any other Contributor, and only if You agree to indemnify,+      defend, and hold each Contributor harmless for any liability+      incurred by, or claims asserted against, such Contributor by reason+      of your accepting any such warranty or additional liability.++   END OF TERMS AND CONDITIONS++   APPENDIX: How to apply the Apache License to your work.++      To apply the Apache License to your work, attach the following+      boilerplate notice, with the fields enclosed by brackets "[]"+      replaced with your own identifying information. (Don't include+      the brackets!)  The text should be enclosed in the appropriate+      comment syntax for the file format. We also recommend that a+      file or class name and description of purpose be included on the+      same "printed page" as the copyright notice for easier+      identification within third-party archives.++   Copyright [yyyy] [name of copyright owner]++   Licensed under the Apache License, Version 2.0 (the "License");+   you may not use this file except in compliance with the License.+   You may obtain a copy of the License at++       http://www.apache.org/licenses/LICENSE-2.0++   Unless required by applicable law or agreed to in writing, software+   distributed under the License is distributed on an "AS IS" BASIS,+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+   See the License for the specific language governing permissions and+   limitations under the License.

@@ -0,0 +1,8 @@+# linux-capabilities++[![Hackage](https://img.shields.io/hackage/v/linux-capabilities.svg?logo=haskell)](https://hackage.haskell.org/package/linux-capabilities)+[![Apache-2.0 license](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)++Linux capabilities Haskell data type.++Check the [codegen.hs](./codegen.hs) script to update the source.

@@ -0,0 +1,70 @@+-- | A script to generate the data type+-- runhaskell codegen.hs | ormolu > src/System/Linux/Capabilities.hs+module Main (main) where++import Data.List+import Data.Maybe++-- | returns the list of caps with there comments+readCaps :: IO [String]+readCaps =+  readFile "/usr/include/linux/capability.h"+    >>= (pure . dropEnd . reverse . foldl' go []) . dropBegin . lines+  where+    -- The actual list starts after this line+    dropBegin = drop 1 . dropWhile (not . isInfixOf "POSIX-draft defined capabilities.")+    -- The list ends before this line+    dropEnd = takeWhile (not . isInfixOf "CAP_LAST_CAP")+    push s [] = [s]+    push s (x : xs) = (x <> s <> "\n") : xs+    go :: [String] -> String -> [String]+    go acc s+      -- Drop intermediary comment+      | s == " ** Linux-specific capabilities" = acc+      | "#define CAP_" `isPrefixOf` s = [""] <> push s acc+      | otherwise = push s acc++-- | create data type constructor with documentation+render :: String -> String+render = unlines . haddockPrefix . reverse . foldl' go [] . reverse . lines+  where+    go :: [String] -> String -> [String]+    go acc s+      | "#define CAP_" `isPrefixOf` s = ["    " <> ((!! 1) . words $ s)]+      | otherwise = case makeHaddock s of+        [] -> acc+        x -> acc <> [commentPrefix <> x]+    commentPrefix = "    -- "+    haddockPrefix (x : xs) = ("    -- | " <> stripPrefix' commentPrefix x) : xs+    haddockPrefix [] = []+    stripPrefix' :: String -> String -> String+    stripPrefix' prefix s = fromMaybe s (stripPrefix prefix s)+    makeHaddock :: String -> String+    makeHaddock s =+      stripPrefix' "   "+        . stripPrefix' " ** "+        . stripPrefix' " * "+        . dropWhileEnd (`elem` (['*', '/', ' '] :: [Char]))+        $ makeHaddockList s+    makeHaddockList s+      | "/* " `isPrefixOf` s = "- " <> drop 3 s+      | ":" `isSuffixOf` s = s <> "\n" <> commentPrefix+      | otherwise = s++p :: String -> IO ()+p = putStrLn++main :: IO ()+main = do+  p "{-# LANGUAGE DerivingStrategies #-}"+  p "-- |"+  p "-- Copyright: (c) 2021 Red Hat"+  p "-- SPDX-License-Identifier: Apache-2.0"+  p "-- Maintainer: Tristan de Cacqueray <tdecacqu@redhat.com>"+  p "--"+  p "module System.Linux.Capabilities (Capability (..)) where"+  p ""+  p "-- | Linux capabilities"+  p "data Capability = "+  readCaps >>= mapM_ p . intersperse "   |" . fmap render+  p "  deriving stock (Bounded, Enum, Eq, Read, Show)"

@@ -0,0 +1,46 @@+cabal-version:       2.4+name:                linux-capabilities+version:             0.1.0.0+synopsis:            Linux capabilities Haskell data type+description:+    linux-capabilities provides a data type and documentation for the Linux capabilities(7).+    .+homepage:            https://github.com/softwarefactory-project/linux-capabilities-haskell#readme+bug-reports:         https://github.com/softwarefactory-project/linux-capabilities-haskell/issues+license:             Apache-2.0+license-file:        LICENSE+author:              Tristan de Cacqueray+maintainer:          Tristan de Cacqueray <tdecacqu@redhat.com>+copyright:           2021 Red Hat+category:            System+build-type:          Simple+extra-doc-files:     CHANGELOG.md+                     README.md+extra-source-files:  codegen.hs+tested-with:         GHC == 8.10.3++source-repository head+  type:                git+  location:            https://github.com/softwarefactory-project/linux-capabilities-haskell.git++library+  build-depends:       base < 5+  ghc-options:         -Wall+                       -Wcompat+                       -Widentities+                       -Wincomplete-uni-patterns+                       -Wincomplete-record-updates+  if impl(ghc >= 8.0)+    ghc-options:       -Wredundant-constraints+  if impl(ghc >= 8.2)+    ghc-options:       -fhide-source-paths+  if impl(ghc >= 8.4)+    ghc-options:       -Wmissing-export-lists+                       -Wpartial-fields+  if impl(ghc >= 8.8)+    ghc-options:       -Wmissing-deriving-strategies+  if impl(ghc >= 8.10)+    ghc-options:       -Wunused-packages+  default-language:    Haskell2010+  hs-source-dirs:      src+  exposed-modules:     System.Linux.Capabilities

@@ -0,0 +1,205 @@+{-# LANGUAGE DerivingStrategies #-}++-- |+-- Copyright: (c) 2021 Red Hat+-- SPDX-License-Identifier: Apache-2.0+-- Maintainer: Tristan de Cacqueray <tdecacqu@redhat.com>+module System.Linux.Capabilities (Capability (..)) where++-- | Linux capabilities+data Capability+  = -- | - In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this+    -- overrides the restriction of changing file ownership and group+    -- ownership.+    CAP_CHOWN+  | -- | - Override all DAC access, including ACL execute access if+    -- [_POSIX_ACL] is defined. Excluding DAC access covered by+    -- CAP_LINUX_IMMUTABLE.+    CAP_DAC_OVERRIDE+  | -- | - Overrides all DAC restrictions regarding read and search on files+    -- and directories, including ACL restrictions if [_POSIX_ACL] is+    -- defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.+    CAP_DAC_READ_SEARCH+  | -- | - Overrides all restrictions about allowed operations on files, where+    -- file owner ID must be equal to the user ID, except where CAP_FSETID+    -- is applicable. It doesn't override MAC and DAC restrictions.+    CAP_FOWNER+  | -- | - Overrides the following restrictions that the effective user ID+    -- shall match the file owner ID when setting the S_ISUID and S_ISGID+    -- bits on that file; that the effective group ID (or one of the+    -- supplementary group IDs) shall match the file owner ID when setting+    -- the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are+    -- cleared on successful return from chown(2) (not implemented).+    CAP_FSETID+  | -- | - Overrides the restriction that the real or effective user ID of a+    -- process sending a signal must match the real or effective user ID+    -- of the process receiving the signal.+    CAP_KILL+  | -- | - Allows setgid(2) manipulation+    -- - Allows setgroups(2)+    -- - Allows forged gids on socket credentials passing.+    CAP_SETGID+  | -- | - Allows set*uid(2) manipulation (including fsuid).+    -- - Allows forged pids on socket credentials passing.+    CAP_SETUID+  | -- | - Without VFS support for capabilities:+    --   Transfer any capability in your permitted set to any pid,+    --   remove any capability in your permitted set from any pid+    -- With VFS support for capabilities (neither of above, but)+    --   Add any capability from current's capability bounding set+    --    to the current process' inheritable set+    --   Allow taking bits out of capability bounding set+    --   Allow modification of the securebits for a process+    CAP_SETPCAP+  | -- | - Allow modification of S_IMMUTABLE and S_APPEND file attributes+    CAP_LINUX_IMMUTABLE+  | -- | - Allows binding to TCP/UDP sockets below 1024+    -- - Allows binding to ATM VCIs below 32+    CAP_NET_BIND_SERVICE+  | -- | - Allow broadcasting, listen to multicast+    CAP_NET_BROADCAST+  | -- | - Allow interface configuration+    -- - Allow administration of IP firewall, masquerading and accounting+    -- - Allow setting debug option on sockets+    -- - Allow modification of routing tables+    -- - Allow setting arbitrary process / process group ownership on+    -- sockets+    -- - Allow binding to any address for transparent proxying (also via NET_RAW)+    -- - Allow setting TOS (type of service)+    -- - Allow setting promiscuous mode+    -- - Allow clearing driver statistics+    -- - Allow multicasting+    -- - Allow read/write of device-specific registers+    -- - Allow activation of ATM control sockets+    CAP_NET_ADMIN+  | -- | - Allow use of RAW sockets+    -- - Allow use of PACKET sockets+    -- - Allow binding to any address for transparent proxying (also via NET_ADMIN)+    CAP_NET_RAW+  | -- | - Allow locking of shared memory segments+    -- - Allow mlock and mlockall (which doesn't really have anything to do+    -- with IPC)+    CAP_IPC_LOCK+  | -- | - Override IPC ownership checks+    CAP_IPC_OWNER+  | -- | - Insert and remove kernel modules - modify kernel without limit+    CAP_SYS_MODULE+  | -- | - Allow ioperm/iopl access+    -- - Allow sending USB messages to any device via /dev/bus/usb+    CAP_SYS_RAWIO+  | -- | - Allow use of chroot()+    CAP_SYS_CHROOT+  | -- | - Allow ptrace() of any process+    CAP_SYS_PTRACE+  | -- | - Allow configuration of process accounting+    CAP_SYS_PACCT+  | -- | - Allow configuration of the secure attention key+    -- - Allow administration of the random device+    -- - Allow examination and configuration of disk quotas+    -- - Allow setting the domainname+    -- - Allow setting the hostname+    -- - Allow calling bdflush()+    -- - Allow mount() and umount(), setting up new smb connection+    -- - Allow some autofs root ioctls+    -- - Allow nfsservctl+    -- - Allow VM86_REQUEST_IRQ+    -- - Allow to read/write pci config on alpha+    -- - Allow irix_prctl on mips (setstacksize)+    -- - Allow flushing all cache on m68k (sys_cacheflush)+    -- - Allow removing semaphores+    -- - Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores+    -- and shared memory+    -- - Allow locking/unlocking of shared memory segment+    -- - Allow turning swap on/off+    -- - Allow forged pids on socket credentials passing+    -- - Allow setting readahead and flushing buffers on block devices+    -- - Allow setting geometry in floppy driver+    -- - Allow turning DMA on/off in xd driver+    -- - Allow administration of md devices (mostly the above, but some+    -- extra ioctls)+    -- - Allow tuning the ide driver+    -- - Allow access to the nvram device+    -- - Allow administration of apm_bios, serial and bttv (TV) device+    -- - Allow manufacturer commands in isdn CAPI support driver+    -- - Allow reading non-standardized portions of pci configuration space+    -- - Allow DDI debug ioctl on sbpcd driver+    -- - Allow setting up serial ports+    -- - Allow sending raw qic-117 commands+    -- - Allow enabling/disabling tagged queuing on SCSI controllers and sending+    -- arbitrary SCSI commands+    -- - Allow setting encryption key on loopback filesystem+    -- - Allow setting zone reclaim policy+    -- - Allow everything under CAP_BPF and CAP_PERFMON for backward compatibility+    CAP_SYS_ADMIN+  | -- | - Allow use of reboot()+    CAP_SYS_BOOT+  | -- | - Allow raising priority and setting priority on other (different+    -- UID) processes+    -- - Allow use of FIFO and round-robin (realtime) scheduling on own+    -- processes and setting the scheduling algorithm used by another+    -- process.+    -- - Allow setting cpu affinity on other processes+    -- - Allow setting realtime ioprio class+    -- - Allow setting ioprio class on other processes+    CAP_SYS_NICE+  | -- | - Override resource limits. Set resource limits.+    -- - Override quota limits.+    -- - Override reserved space on ext2 filesystem+    -- - Modify data journaling mode on ext3 filesystem (uses journaling+    -- resources)+    -- - NOTE: ext2 honors fsuid when checking for resource overrides, so+    -- you can override using fsuid too+    -- - Override size restrictions on IPC message queues+    -- - Allow more than 64hz interrupts from the real-time clock+    -- - Override max number of consoles on console allocation+    -- - Override max number of keymaps+    -- - Control memory reclaim behavior+    CAP_SYS_RESOURCE+  | -- | - Allow manipulation of system clock+    -- - Allow irix_stime on mips+    -- - Allow setting the real-time clock+    CAP_SYS_TIME+  | -- | - Allow configuration of tty devices+    -- - Allow vhangup() of tty+    CAP_SYS_TTY_CONFIG+  | -- | - Allow the privileged aspects of mknod()+    CAP_MKNOD+  | -- | - Allow taking of leases on files+    CAP_LEASE+  | -- | - Allow writing the audit log via unicast netlink socket+    CAP_AUDIT_WRITE+  | -- | - Allow configuration of audit via unicast netlink socket+    CAP_AUDIT_CONTROL+  | -- | - Set or remove capabilities on files+    CAP_SETFCAP+  | -- | - Override MAC access.+    -- The base kernel enforces no MAC policy.+    -- An LSM may enforce a MAC policy, and if it does and it chooses+    -- to implement capability based overrides of that policy, this is+    -- the capability it should use to do so.+    CAP_MAC_OVERRIDE+  | -- | - Allow MAC configuration or state changes.+    -- The base kernel requires no MAC configuration.+    -- An LSM may enforce a MAC policy, and if it does and it chooses+    -- to implement capability based checks on modifications to that+    -- policy or the data required to maintain it, this is the+    -- capability it should use to do so.+    CAP_MAC_ADMIN+  | -- | - Allow configuring the kernel's syslog (printk behaviour)+    CAP_SYSLOG+  | -- | - Allow triggering something that will wake the system+    CAP_WAKE_ALARM+  | -- | - Allow preventing system suspends+    CAP_BLOCK_SUSPEND+  | -- | - Allow reading the audit log via multicast netlink socket+    CAP_AUDIT_READ+  | -- | - Allow system performance and observability privileged operations+    -- using perf_events, i915_perf and other kernel subsystems+    CAP_PERFMON+  | -- | - CAP_BPF allows BPF operations+    CAP_BPF+  | -- | - Allow checkpoint/restore related operations+    -- - Allow PID selection during clone3()+    -- - Allow writing to ns_last_pid+    CAP_CHECKPOINT_RESTORE+  deriving stock (Bounded, Enum, Eq, Read, Show)