1*2810ac1bSKiyoung KimAllows a process to perform a somewhat arbitrary 2*2810ac1bSKiyoung Kimgrab-bag of privileged operations. Over time, this 3*2810ac1bSKiyoung Kimcapability should weaken as specific capabilities are 4*2810ac1bSKiyoung Kimcreated for subsets of CAP_SYS_ADMINs functionality: 5*2810ac1bSKiyoung Kim - configuration of the secure attention key 6*2810ac1bSKiyoung Kim - administration of the random device 7*2810ac1bSKiyoung Kim - examination and configuration of disk quotas 8*2810ac1bSKiyoung Kim - setting the domainname 9*2810ac1bSKiyoung Kim - setting the hostname 10*2810ac1bSKiyoung Kim - calling bdflush() 11*2810ac1bSKiyoung Kim - mount() and umount(), setting up new SMB connection 12*2810ac1bSKiyoung Kim - some autofs root ioctls 13*2810ac1bSKiyoung Kim - nfsservctl 14*2810ac1bSKiyoung Kim - VM86_REQUEST_IRQ 15*2810ac1bSKiyoung Kim - to read/write pci config on alpha 16*2810ac1bSKiyoung Kim - irix_prctl on mips (setstacksize) 17*2810ac1bSKiyoung Kim - flushing all cache on m68k (sys_cacheflush) 18*2810ac1bSKiyoung Kim - removing semaphores 19*2810ac1bSKiyoung Kim - Used instead of CAP_CHOWN to "chown" IPC message 20*2810ac1bSKiyoung Kim queues, semaphores and shared memory 21*2810ac1bSKiyoung Kim - locking/unlocking of shared memory segment 22*2810ac1bSKiyoung Kim - turning swap on/off 23*2810ac1bSKiyoung Kim - forged pids on socket credentials passing 24*2810ac1bSKiyoung Kim - setting readahead and flushing buffers on block 25*2810ac1bSKiyoung Kim devices 26*2810ac1bSKiyoung Kim - setting geometry in floppy driver 27*2810ac1bSKiyoung Kim - turning DMA on/off in xd driver 28*2810ac1bSKiyoung Kim - administration of md devices (mostly the above, but 29*2810ac1bSKiyoung Kim some extra ioctls) 30*2810ac1bSKiyoung Kim - tuning the ide driver 31*2810ac1bSKiyoung Kim - access to the nvram device 32*2810ac1bSKiyoung Kim - administration of apm_bios, serial and bttv (TV) 33*2810ac1bSKiyoung Kim device 34*2810ac1bSKiyoung Kim - manufacturer commands in isdn CAPI support driver 35*2810ac1bSKiyoung Kim - reading non-standardized portions of PCI 36*2810ac1bSKiyoung Kim configuration space 37*2810ac1bSKiyoung Kim - DDI debug ioctl on sbpcd driver 38*2810ac1bSKiyoung Kim - setting up serial ports 39*2810ac1bSKiyoung Kim - sending raw qic-117 commands 40*2810ac1bSKiyoung Kim - enabling/disabling tagged queuing on SCSI 41*2810ac1bSKiyoung Kim controllers and sending arbitrary SCSI commands 42*2810ac1bSKiyoung Kim - setting encryption key on loopback filesystem 43*2810ac1bSKiyoung Kim - setting zone reclaim policy 44