-- Hoogle documentation, generated by Haddock
-- See Hoogle, http://www.haskell.org/hoogle/


-- | Linux capabilities Haskell data type
--   
--   linux-capabilities provides a data type and documentation for the
--   Linux capabilities(7).
@package linux-capabilities
@version 0.1.0.0


module System.Linux.Capabilities

-- | Linux capabilities
data Capability

-- | <ul>
--   <li>In a system with the [_POSIX_CHOWN_RESTRICTED] option defined,
--   this overrides the restriction of changing file ownership and group
--   ownership.</li>
--   </ul>
CAP_CHOWN :: Capability

-- | <ul>
--   <li>Override all DAC access, including ACL execute access if
--   [_POSIX_ACL] is defined. Excluding DAC access covered by
--   CAP_LINUX_IMMUTABLE.</li>
--   </ul>
CAP_DAC_OVERRIDE :: Capability

-- | <ul>
--   <li>Overrides all DAC restrictions regarding read and search on files
--   and directories, including ACL restrictions if [_POSIX_ACL] is
--   defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.</li>
--   </ul>
CAP_DAC_READ_SEARCH :: Capability

-- | <ul>
--   <li>Overrides all restrictions about allowed operations on files,
--   where file owner ID must be equal to the user ID, except where
--   CAP_FSETID is applicable. It doesn't override MAC and DAC
--   restrictions.</li>
--   </ul>
CAP_FOWNER :: Capability

-- | <ul>
--   <li>Overrides the following restrictions that the effective user ID
--   shall match the file owner ID when setting the S_ISUID and S_ISGID
--   bits on that file; that the effective group ID (or one of the
--   supplementary group IDs) shall match the file owner ID when setting
--   the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are
--   cleared on successful return from chown(2) (not implemented).</li>
--   </ul>
CAP_FSETID :: Capability

-- | <ul>
--   <li>Overrides the restriction that the real or effective user ID of a
--   process sending a signal must match the real or effective user ID of
--   the process receiving the signal.</li>
--   </ul>
CAP_KILL :: Capability

-- | <ul>
--   <li>Allows setgid(2) manipulation</li>
--   <li>Allows setgroups(2)</li>
--   <li>Allows forged gids on socket credentials passing.</li>
--   </ul>
CAP_SETGID :: Capability

-- | <ul>
--   <li>Allows set*uid(2) manipulation (including fsuid).</li>
--   <li>Allows forged pids on socket credentials passing.</li>
--   </ul>
CAP_SETUID :: Capability

-- | <ul>
--   <li>Without VFS support for capabilities: Transfer any capability in
--   your permitted set to any pid, remove any capability in your permitted
--   set from any pid With VFS support for capabilities (neither of above,
--   but) Add any capability from current's capability bounding set to the
--   current process' inheritable set Allow taking bits out of capability
--   bounding set Allow modification of the securebits for a process</li>
--   </ul>
CAP_SETPCAP :: Capability

-- | <ul>
--   <li>Allow modification of S_IMMUTABLE and S_APPEND file
--   attributes</li>
--   </ul>
CAP_LINUX_IMMUTABLE :: Capability

-- | <ul>
--   <li>Allows binding to TCP/UDP sockets below 1024</li>
--   <li>Allows binding to ATM VCIs below 32</li>
--   </ul>
CAP_NET_BIND_SERVICE :: Capability

-- | <ul>
--   <li>Allow broadcasting, listen to multicast</li>
--   </ul>
CAP_NET_BROADCAST :: Capability

-- | <ul>
--   <li>Allow interface configuration</li>
--   <li>Allow administration of IP firewall, masquerading and
--   accounting</li>
--   <li>Allow setting debug option on sockets</li>
--   <li>Allow modification of routing tables</li>
--   <li>Allow setting arbitrary process / process group ownership on
--   sockets</li>
--   <li>Allow binding to any address for transparent proxying (also via
--   NET_RAW)</li>
--   <li>Allow setting TOS (type of service)</li>
--   <li>Allow setting promiscuous mode</li>
--   <li>Allow clearing driver statistics</li>
--   <li>Allow multicasting</li>
--   <li>Allow read/write of device-specific registers</li>
--   <li>Allow activation of ATM control sockets</li>
--   </ul>
CAP_NET_ADMIN :: Capability

-- | <ul>
--   <li>Allow use of RAW sockets</li>
--   <li>Allow use of PACKET sockets</li>
--   <li>Allow binding to any address for transparent proxying (also via
--   NET_ADMIN)</li>
--   </ul>
CAP_NET_RAW :: Capability

-- | <ul>
--   <li>Allow locking of shared memory segments</li>
--   <li>Allow mlock and mlockall (which doesn't really have anything to do
--   with IPC)</li>
--   </ul>
CAP_IPC_LOCK :: Capability

-- | <ul>
--   <li>Override IPC ownership checks</li>
--   </ul>
CAP_IPC_OWNER :: Capability

-- | <ul>
--   <li>Insert and remove kernel modules - modify kernel without
--   limit</li>
--   </ul>
CAP_SYS_MODULE :: Capability

-- | <ul>
--   <li>Allow ioperm/iopl access</li>
--   <li>Allow sending USB messages to any device via
--   <i>dev</i>bus/usb</li>
--   </ul>
CAP_SYS_RAWIO :: Capability

-- | <ul>
--   <li>Allow use of chroot()</li>
--   </ul>
CAP_SYS_CHROOT :: Capability

-- | <ul>
--   <li>Allow ptrace() of any process</li>
--   </ul>
CAP_SYS_PTRACE :: Capability

-- | <ul>
--   <li>Allow configuration of process accounting</li>
--   </ul>
CAP_SYS_PACCT :: Capability

-- | <ul>
--   <li>Allow configuration of the secure attention key</li>
--   <li>Allow administration of the random device</li>
--   <li>Allow examination and configuration of disk quotas</li>
--   <li>Allow setting the domainname</li>
--   <li>Allow setting the hostname</li>
--   <li>Allow calling bdflush()</li>
--   <li>Allow mount() and umount(), setting up new smb connection</li>
--   <li>Allow some autofs root ioctls</li>
--   <li>Allow nfsservctl</li>
--   <li>Allow VM86_REQUEST_IRQ</li>
--   <li>Allow to read/write pci config on alpha</li>
--   <li>Allow irix_prctl on mips (setstacksize)</li>
--   <li>Allow flushing all cache on m68k (sys_cacheflush)</li>
--   <li>Allow removing semaphores</li>
--   <li>Used instead of CAP_CHOWN to "chown" IPC message queues,
--   semaphores and shared memory</li>
--   <li>Allow locking/unlocking of shared memory segment</li>
--   <li>Allow turning swap on/off</li>
--   <li>Allow forged pids on socket credentials passing</li>
--   <li>Allow setting readahead and flushing buffers on block devices</li>
--   <li>Allow setting geometry in floppy driver</li>
--   <li>Allow turning DMA on/off in xd driver</li>
--   <li>Allow administration of md devices (mostly the above, but some
--   extra ioctls)</li>
--   <li>Allow tuning the ide driver</li>
--   <li>Allow access to the nvram device</li>
--   <li>Allow administration of apm_bios, serial and bttv (TV) device</li>
--   <li>Allow manufacturer commands in isdn CAPI support driver</li>
--   <li>Allow reading non-standardized portions of pci configuration
--   space</li>
--   <li>Allow DDI debug ioctl on sbpcd driver</li>
--   <li>Allow setting up serial ports</li>
--   <li>Allow sending raw qic-117 commands</li>
--   <li>Allow enabling/disabling tagged queuing on SCSI controllers and
--   sending arbitrary SCSI commands</li>
--   <li>Allow setting encryption key on loopback filesystem</li>
--   <li>Allow setting zone reclaim policy</li>
--   <li>Allow everything under CAP_BPF and CAP_PERFMON for backward
--   compatibility</li>
--   </ul>
CAP_SYS_ADMIN :: Capability

-- | <ul>
--   <li>Allow use of reboot()</li>
--   </ul>
CAP_SYS_BOOT :: Capability

-- | <ul>
--   <li>Allow raising priority and setting priority on other (different
--   UID) processes</li>
--   <li>Allow use of FIFO and round-robin (realtime) scheduling on own
--   processes and setting the scheduling algorithm used by another
--   process.</li>
--   <li>Allow setting cpu affinity on other processes</li>
--   <li>Allow setting realtime ioprio class</li>
--   <li>Allow setting ioprio class on other processes</li>
--   </ul>
CAP_SYS_NICE :: Capability

-- | <ul>
--   <li>Override resource limits. Set resource limits.</li>
--   <li>Override quota limits.</li>
--   <li>Override reserved space on ext2 filesystem</li>
--   <li>Modify data journaling mode on ext3 filesystem (uses journaling
--   resources)</li>
--   <li>NOTE: ext2 honors fsuid when checking for resource overrides, so
--   you can override using fsuid too</li>
--   <li>Override size restrictions on IPC message queues</li>
--   <li>Allow more than 64hz interrupts from the real-time clock</li>
--   <li>Override max number of consoles on console allocation</li>
--   <li>Override max number of keymaps</li>
--   <li>Control memory reclaim behavior</li>
--   </ul>
CAP_SYS_RESOURCE :: Capability

-- | <ul>
--   <li>Allow manipulation of system clock</li>
--   <li>Allow irix_stime on mips</li>
--   <li>Allow setting the real-time clock</li>
--   </ul>
CAP_SYS_TIME :: Capability

-- | <ul>
--   <li>Allow configuration of tty devices</li>
--   <li>Allow vhangup() of tty</li>
--   </ul>
CAP_SYS_TTY_CONFIG :: Capability

-- | <ul>
--   <li>Allow the privileged aspects of mknod()</li>
--   </ul>
CAP_MKNOD :: Capability

-- | <ul>
--   <li>Allow taking of leases on files</li>
--   </ul>
CAP_LEASE :: Capability

-- | <ul>
--   <li>Allow writing the audit log via unicast netlink socket</li>
--   </ul>
CAP_AUDIT_WRITE :: Capability

-- | <ul>
--   <li>Allow configuration of audit via unicast netlink socket</li>
--   </ul>
CAP_AUDIT_CONTROL :: Capability

-- | <ul>
--   <li>Set or remove capabilities on files</li>
--   </ul>
CAP_SETFCAP :: Capability

-- | <ul>
--   <li>Override MAC access. The base kernel enforces no MAC policy. An
--   LSM may enforce a MAC policy, and if it does and it chooses to
--   implement capability based overrides of that policy, this is the
--   capability it should use to do so.</li>
--   </ul>
CAP_MAC_OVERRIDE :: Capability

-- | <ul>
--   <li>Allow MAC configuration or state changes. The base kernel requires
--   no MAC configuration. An LSM may enforce a MAC policy, and if it does
--   and it chooses to implement capability based checks on modifications
--   to that policy or the data required to maintain it, this is the
--   capability it should use to do so.</li>
--   </ul>
CAP_MAC_ADMIN :: Capability

-- | <ul>
--   <li>Allow configuring the kernel's syslog (printk behaviour)</li>
--   </ul>
CAP_SYSLOG :: Capability

-- | <ul>
--   <li>Allow triggering something that will wake the system</li>
--   </ul>
CAP_WAKE_ALARM :: Capability

-- | <ul>
--   <li>Allow preventing system suspends</li>
--   </ul>
CAP_BLOCK_SUSPEND :: Capability

-- | <ul>
--   <li>Allow reading the audit log via multicast netlink socket</li>
--   </ul>
CAP_AUDIT_READ :: Capability

-- | <ul>
--   <li>Allow system performance and observability privileged operations
--   using perf_events, i915_perf and other kernel subsystems</li>
--   </ul>
CAP_PERFMON :: Capability

-- | <ul>
--   <li>CAP_BPF allows BPF operations</li>
--   </ul>
CAP_BPF :: Capability

-- | <ul>
--   <li>Allow checkpoint/restore related operations</li>
--   <li>Allow PID selection during clone3()</li>
--   <li>Allow writing to ns_last_pid</li>
--   </ul>
CAP_CHECKPOINT_RESTORE :: Capability
instance GHC.Show.Show System.Linux.Capabilities.Capability
instance GHC.Read.Read System.Linux.Capabilities.Capability
instance GHC.Classes.Eq System.Linux.Capabilities.Capability
instance GHC.Enum.Enum System.Linux.Capabilities.Capability
instance GHC.Enum.Bounded System.Linux.Capabilities.Capability