[minijail] Add the ability to set capabilities from the command line

options.h

 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 // Some portions Copyright (c) 2009 The Chromium Authors.
 //
 // Options abstract class for minijails.
 #ifndef __CHROMEOS_MINIJAIL_OPTIONS_H
 #define __CHROMEOS_MINIJAIL_OPTIONS_H
 
 #include <base/basictypes.h>
 #include <base/logging.h>
 #include <base/scoped_ptr.h>
 
 #include "minijail/env.h"
 
 namespace chromeos {
 namespace minijail {
 
 class Options {
  public:
   Options() : env_(new Env),
               executable_path_(NULL),
               argument_count_(0),
               arguments_(NULL),
               environment_(NULL),
               add_readonly_mounts_(false),
+              caps_bitmask_(0),
               change_gid_(false),
               change_uid_(false),
               disable_tracing_(false),
               enforce_syscalls_benchmark_(false),
               enforce_syscalls_by_source_(false),
               gid_(0),
               namespace_vfs_(false),
               namespace_pid_(false),
               sanitize_environment_(false),
               uid_(0),
@@ skipping 66 matching lines @@
   virtual bool sanitize_environment() const
     { return sanitize_environment_; }
   // The value passed with this is the numeric UID to transition to.
   virtual void set_uid(uid_t val) { uid_ = val; change_uid_ = true; }
   virtual uid_t uid() const { return uid_; }
   // Enables the use and sanitization of POSIX capabilities.
   // Without kKeepCapabilities, all capabilities save CAP_SETPCAP are
   // removed from the effective, inherited, permitted and bounding sets.
   virtual void set_use_capabilities(bool val) { use_capabilities_ = val; }
   virtual bool use_capabilities() const { return use_capabilities_; }
+  // The set of caps to use when use_capabilities is set.
+  virtual void set_caps_bitmask(uint64 val) { caps_bitmask_ = val; }
+  virtual uint64 caps_bitmask() const { return caps_bitmask_; }
 
 #if 0
   TODO(wad): additional functionality:
   virtual void set_cgroup_dir(const string& val) { cgroup_dir_ = val; }
   virtual const string& cgroup_dir() const { return cgroup_dir_; }
 
   virtual void set_supplemental_groups(std::vector<std::string>& val)
     { supplemental_groups_ = val; }
   virtual const std::vector<std::string> *supplemental_groups() const
     { return supplemental_groups_; }
 
-  virtual void set_bounding_set(uint64 val) { bounding_set_ = val; }
-  virtual uint64 bounding_set() const { return bounding_set_; }
-
   virtual void set_use_delayed_chroot(bool val) { use_delayed_chroot_ = val; }
   virtual bool use_delayed_chroot() const { return use_delayed_chroot_; }
 
   virtual void set_memory_limit(int64 val) { memory_limit_ = val; }
   virtual int64 memory_limit() const { return memory_limit_; }
 
   virtual void set_cpu_limit(int64 val) { cpu_limit_ = val; }
   virtual int64 cpu_limit() const { return cpu_limit_; }
 
   virtual void set_open_file_limit(int32 val) { open_file_limit_ = val; }
@@ skipping 19 matching lines @@
 
 
  private:
   scoped_ptr<Env> env_;
   const char *executable_path_;
   int argument_count_;
   char * const *arguments_;
   char * const *environment_;
 
   bool add_readonly_mounts_;
+  uint64 caps_bitmask_;
   bool change_gid_;
   bool change_uid_;
   bool disable_tracing_;
   bool enforce_syscalls_benchmark_;
   bool enforce_syscalls_by_source_;
   gid_t gid_;
   bool namespace_vfs_;
   bool namespace_pid_;
   bool sanitize_environment_;
   uid_t uid_;
   bool use_capabilities_;
 
   DISALLOW_COPY_AND_ASSIGN(Options);
 };
 
 }  // namespace minijail
 }  // namespace chromeos
 
 #endif  // __CHROMEOS_MINIJAIL_OPTIONS_H