115 lines
2.8 KiB
TOML
115 lines
2.8 KiB
TOML
# MontaukOS capability grants
|
|
#
|
|
#
|
|
# Capability names: process_admin, power_request, power_control, suspend,
|
|
# storage_admin, raw_storage, network_admin, set_time, user_admin,
|
|
# display_admin, device_admin, log_read, system_image, compositor and "all".
|
|
#
|
|
|
|
# ==== System services (started by init) ====
|
|
|
|
[grant.dhcp]
|
|
path = "0:/os/dhcp.elf"
|
|
effective = ["network_admin"]
|
|
|
|
[grant.ntp]
|
|
path = "0:/os/ntp.elf"
|
|
effective = ["set_time"]
|
|
|
|
[grant.login]
|
|
path = "0:/os/login.elf"
|
|
effective = [
|
|
"power_control", "storage_admin", "device_admin",
|
|
"user_admin", "process_admin", "log_read",
|
|
]
|
|
delegable = [
|
|
"power_request", "suspend", "process_admin", "storage_admin",
|
|
"raw_storage", "network_admin", "set_time", "user_admin",
|
|
"display_admin", "device_admin", "log_read", "compositor",
|
|
]
|
|
|
|
[grant.sshd]
|
|
path = "0:/os/sshd.elf"
|
|
effective = ["user_admin"]
|
|
|
|
[grant.desktop]
|
|
path = "0:/os/desktop.elf"
|
|
effective = [
|
|
"power_request", "suspend", "process_admin", "storage_admin",
|
|
"raw_storage", "network_admin", "set_time", "user_admin",
|
|
"display_admin", "device_admin", "log_read", "compositor",
|
|
]
|
|
delegable = [
|
|
"power_request", "suspend", "process_admin", "storage_admin",
|
|
"raw_storage", "network_admin", "set_time", "user_admin",
|
|
"display_admin", "device_admin", "log_read",
|
|
]
|
|
|
|
[grant.terminal]
|
|
path = "0:/apps/terminal/terminal.elf"
|
|
delegable = ["all"]
|
|
|
|
[grant.shell]
|
|
path = "0:/os/shell.elf"
|
|
effective = ["power_request", "suspend"]
|
|
delegable = ["all"]
|
|
|
|
# ==== Settings and administrative applications ====
|
|
|
|
[grant.procmgr]
|
|
path = "0:/apps/procmgr/procmgr.elf"
|
|
effective = ["process_admin"]
|
|
|
|
# May restart the DHCP client, so it needs to pass network_admin on.
|
|
[grant.network]
|
|
path = "0:/apps/network/network.elf"
|
|
effective = ["network_admin"]
|
|
delegable = ["network_admin"]
|
|
|
|
[grant.display]
|
|
path = "0:/apps/display/display.elf"
|
|
effective = ["display_admin"]
|
|
|
|
[grant.disks]
|
|
path = "0:/apps/disks/disks.elf"
|
|
effective = ["storage_admin", "raw_storage"]
|
|
|
|
[grant.installer]
|
|
path = "0:/apps/installer/installer.elf"
|
|
effective = ["storage_admin", "raw_storage"]
|
|
|
|
[grant.timezone]
|
|
path = "0:/apps/timezone/timezone.elf"
|
|
effective = ["set_time"]
|
|
|
|
[grant.bluetooth]
|
|
path = "0:/apps/bluetooth/bluetooth.elf"
|
|
effective = ["device_admin"]
|
|
|
|
# Writes 0:/config/consent.toml when a stored consent decision is forgotten.
|
|
[grant.capabilities]
|
|
path = "0:/apps/capabilities/capabilities.elf"
|
|
effective = ["user_admin"]
|
|
|
|
[grant.syslog]
|
|
path = "0:/apps/syslog/syslog.elf"
|
|
effective = ["log_read"]
|
|
|
|
[grant.sshserver]
|
|
path = "0:/apps/sshserver/sshserver.elf"
|
|
effective = ["user_admin"]
|
|
|
|
# ==== Console tools ====
|
|
|
|
[grant.ifconfig]
|
|
path = "0:/os/ifconfig.elf"
|
|
effective = ["network_admin"]
|
|
|
|
[grant.wifi]
|
|
path = "0:/os/wifi.elf"
|
|
effective = ["network_admin"]
|
|
|
|
[grant.sdr]
|
|
path = "0:/os/sdr.elf"
|
|
effective = ["device_admin"]
|