lfs-book-zh_CN/chapter06/libcap.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
  <!ENTITY % general-entities SYSTEM "../general.ent">
  %general-entities;
]>

<sect1 id="ch-system-libcap" role="wrap">
  <?dbhtml filename="libcap.html"?>

  <sect1info condition="script">
    <productname>libcap</productname>
    <productnumber>&libcap-version;</productnumber>
    <address>&libcap-url;</address>
  </sect1info>

  <title>Libcap-&libcap-version;</title>

  <indexterm zone="ch-system-libcap">
    <primary sortas="a-Libcap">Libcap</primary>
  </indexterm>

  <sect2 role="package">
    <title/>

    <para>Libcap 软件包为 Linux 内核提供的 POSIX 1003.1e
		权能字实现用户接口。这些权能字是 root
		用户的最高特权分割成的一组不同权限。</para>

    <segmentedlist>
      <segtitle>&buildtime;</segtitle>
      <segtitle>&diskspace;</segtitle>

      <seglistitem>
        <seg>&libcap-ch6-sbu;</seg>
        <seg>&libcap-ch6-du;</seg>
      </seglistitem>
    </segmentedlist>

  </sect2>

  <sect2 role="installation">
    <title>安装 Libcap</title>

    <para>防止静态库的安装：</para>

<screen><userinput remap="pre">sed -i '/install.*STALIBNAME/d' libcap/Makefile</userinput></screen>

    <para>编译该软件包：</para>

<screen><userinput remap="make">make</userinput></screen>

    <para>该软件包不包含测试套件。</para>

    <para>安装该软件包：</para>

<screen><userinput remap="install">make RAISE_SETFCAP=no lib=lib prefix=/usr install
chmod -v 755 /usr/lib/libcap.so.&libcap-version;</userinput></screen>

    <variablelist>
      <title>make 命令选项的含义：</title>

      <varlistentry>
        <term><parameter>RAISE_SETFCAP=no</parameter></term>
        <listitem>
          <para>该参数跳过对 <command>setcap</command> 使用它本身的步骤。
          这可以避免在不支持扩展权能字的内核或文件系统上发生安装错误。
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><parameter>lib=lib</parameter></term>
        <listitem>
          <para>在 x86_64 上，该参数将库安装在
          <filename>$prefix/lib</filename>，而不是
          <filename>$prefix/lib64</filename>。 它在 x86 上没有作用。</para>
        </listitem>
      </varlistentry>
 
    </variablelist>

    <para>需要把共享库移动到
    <filename class="directory">/lib</filename>，因此
    <filename class="directory">/usr/lib</filename> 中的
	<filename class="extension">.so</filename> 符号链接需要重新建立：</para>

<screen><userinput remap="install">mv -v /usr/lib/libcap.so.* /lib
ln -sfv ../../lib/$(readlink /usr/lib/libcap.so) /usr/lib/libcap.so</userinput></screen>

  </sect2>

  <sect2 id="contents-libcap" role="content">
    <title>Libcap 的内容</title>

    <segmentedlist>
      <segtitle>安装的程序</segtitle>
      <segtitle>安装的库</segtitle>

      <seglistitem>
        <seg>capsh, getcap, getpcaps, 以及 setcap</seg>
        <seg>libcap.so</seg>
      </seglistitem>
    </segmentedlist>

    <variablelist>
      <bridgehead renderas="sect3">简要描述</bridgehead>
      <?dbfo list-presentation="list"?>
      <?dbhtml list-presentation="table"?>

      <varlistentry id="capsh">
        <term><command>capsh</command></term>
        <listitem>
          <para>一个用于演示和限制 Linux 权能字的 shell 封装器</para>
          <indexterm zone="ch-system-libcap capsh">
            <primary sortas="b-capsh">capsh</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="getcap">
        <term><command>getcap</command></term>
        <listitem>
          <para>检验文件权能字</para>
          <indexterm zone="ch-system-libcap getcap">
            <primary sortas="b-getcap">getcap</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="getpcaps">
        <term><command>getpcaps</command></term>
        <listitem>
          <para>查询进程的权能字</para>
          <indexterm zone="ch-system-libcap getpcaps">
            <primary sortas="b-getpcaps">getpcaps</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="setcap">
        <term><command>setcap</command></term>
        <listitem>
          <para>设定文件权能字</para>
          <indexterm zone="ch-system-libcap setcap">
            <primary sortas="b-setcap">setcap</primary>
          </indexterm>
        </listitem>
      </varlistentry>

      <varlistentry id="libcap">
        <term><filename class="libraryfile">libcap</filename></term>
        <listitem>
          <para>包含操作 POSIX 1003.1e 权能字的库函数</para>
          <indexterm zone="ch-system-libcap libcap">
            <primary sortas="c-libcap">libcap</primary>
          </indexterm>
        </listitem>
      </varlistentry>

    </variablelist>

  </sect2>

</sect1>