先帝创业未半而中道崩殂，今天下三分，益州疲弊，此诚危急存亡之秋也。然侍卫之臣不懈于内，忠志之士忘身于外者，盖追先帝之殊遇，欲报之于陛下也。诚宜开张圣听，以光先帝遗德，恢弘志士之气，不宜妄自菲薄，引喻失义，以塞忠谏之路也先帝は天下を興す志半ばにして志半ばにして崩御されました。今、天下は三つに分かれ、益州は疲弊しており、まさに存亡の危機に瀕しております。しかしながら、宮中で職務に励む臣下や、外地で身を顧みず尽力する志士たちがいるのは、ひとえに先帝から受けた格別な恩義を思い、陛下に報いようとする志があるからです。今こそ陛下には広く臣下の意見に耳を傾け、先帝の遺徳を輝かせ、志士たちの士気を高めるべきです。決して自らを卑下したり、不適切な例えを用いて忠言の道を閉ざしたりしてはなりません。鍏堝笣鍒涗笟鏈崐鑰屼腑閬撳穿娈傦紝浠婂ぉ涓嬩笁鍒嗭紝鐩婂窞鐤插紛锛屾璇氬嵄鎬ュ瓨浜′箣绉嬩篃銆傜劧渚嶅崼涔嬭嚕涓嶆噲浜庡唴锛屽繝蹇椾箣澹繕韬簬澶栬€咃紝鐩栬拷鍏堝笣涔嬫畩閬囷紝娆叉姤涔嬩簬闄涗笅涔熴€傝瘹瀹滃紑寮犲湥鍚紝浠ュ厜鍏堝笣閬楀痉锛屾仮寮樺織澹箣姘旓紝涓嶅疁濡勮嚜鑿茶杽锛屽紩鍠诲け涔夛紝浠ュ蹇犺皬涔嬭矾涔🌌 SpectraShell

🌌 SpectraShell

Current path: usr/include/linux/


⬆️ Go up: /usr/include

📄 Viewing: securebits.h

/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _LINUX_SECUREBITS_H
#define _LINUX_SECUREBITS_H

/* Each securesetting is implemented using two bits. One bit specifies
   whether the setting is on or off. The other bit specify whether the
   setting is locked or not. A setting which is locked cannot be
   changed from user-level. */
#define issecure_mask(X)	(1 << (X))

#define SECUREBITS_DEFAULT 0x00000000

/* When set UID 0 has no special privileges. When unset, we support
   inheritance of root-permissions and suid-root executable under
   compatibility mode. We raise the effective and inheritable bitmasks
   *of the executable file* if the effective uid of the new process is
   0. If the real uid is 0, we raise the effective (legacy) bit of the
   executable file. */
#define SECURE_NOROOT			0
#define SECURE_NOROOT_LOCKED		1  /* make bit-0 immutable */

#define SECBIT_NOROOT		(issecure_mask(SECURE_NOROOT))
#define SECBIT_NOROOT_LOCKED	(issecure_mask(SECURE_NOROOT_LOCKED))

/* When set, setuid to/from uid 0 does not trigger capability-"fixup".
   When unset, to provide compatiblility with old programs relying on
   set*uid to gain/lose privilege, transitions to/from uid 0 cause
   capabilities to be gained/lost. */
#define SECURE_NO_SETUID_FIXUP		2
#define SECURE_NO_SETUID_FIXUP_LOCKED	3  /* make bit-2 immutable */

#define SECBIT_NO_SETUID_FIXUP	(issecure_mask(SECURE_NO_SETUID_FIXUP))
#define SECBIT_NO_SETUID_FIXUP_LOCKED \
			(issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED))

/* When set, a process can retain its capabilities even after
   transitioning to a non-root user (the set-uid fixup suppressed by
   bit 2). Bit-4 is cleared when a process calls exec(); setting both
   bit 4 and 5 will create a barrier through exec that no exec()'d
   child can use this feature again. */
#define SECURE_KEEP_CAPS		4
#define SECURE_KEEP_CAPS_LOCKED		5  /* make bit-4 immutable */

#define SECBIT_KEEP_CAPS	(issecure_mask(SECURE_KEEP_CAPS))
#define SECBIT_KEEP_CAPS_LOCKED (issecure_mask(SECURE_KEEP_CAPS_LOCKED))

/* When set, a process cannot add new capabilities to its ambient set. */
#define SECURE_NO_CAP_AMBIENT_RAISE		6
#define SECURE_NO_CAP_AMBIENT_RAISE_LOCKED	7  /* make bit-6 immutable */

#define SECBIT_NO_CAP_AMBIENT_RAISE (issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE))
#define SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED \
			(issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE_LOCKED))

#define SECURE_ALL_BITS		(issecure_mask(SECURE_NOROOT) | \
				 issecure_mask(SECURE_NO_SETUID_FIXUP) | \
				 issecure_mask(SECURE_KEEP_CAPS) | \
				 issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE))
#define SECURE_ALL_LOCKS	(SECURE_ALL_BITS << 1)

#endif /* _LINUX_SECUREBITS_H */

📁