127 lines
3.5 KiB
TOML
127 lines
3.5 KiB
TOML
# MontaukOS capability grants
|
|
#
|
|
#
|
|
# Capability names: process_admin, power_request, power_control, suspend,
|
|
# storage_admin, raw_storage, network_admin, set_time, user_admin,
|
|
# display_admin, device_admin, log_read, system_image, and "all".
|
|
#
|
|
# "all" is every capability except system_image, which must always be named
|
|
# explicitly: it is write access to 0:/os and 0:/apps, and since grants are
|
|
# keyed on binary path, holding it is equivalent to holding every capability
|
|
# the system can issue from the next launch onwards. Nothing is granted it.
|
|
#
|
|
# A grant is always clamped by the kernel to what the launching process may
|
|
# actually delegate, so "all" in a launcher entry means "whatever this session
|
|
# was given", not "root".
|
|
#
|
|
#
|
|
|
|
# ==== System services (started by init) ====
|
|
|
|
[grant.dhcp]
|
|
path = "0:/os/dhcp.elf"
|
|
effective = ["network_admin"]
|
|
|
|
[grant.ntp]
|
|
path = "0:/os/ntp.elf"
|
|
effective = ["set_time"]
|
|
|
|
[grant.login]
|
|
path = "0:/os/login.elf"
|
|
permitted = ["all"]
|
|
effective = [
|
|
"power_control", "storage_admin", "device_admin",
|
|
"user_admin", "process_admin", "log_read",
|
|
]
|
|
delegable = [
|
|
"power_request", "suspend", "process_admin", "storage_admin",
|
|
"raw_storage", "network_admin", "set_time", "user_admin",
|
|
"display_admin", "device_admin", "log_read",
|
|
]
|
|
|
|
[grant.sshd]
|
|
path = "0:/os/sshd.elf"
|
|
effective = ["user_admin"]
|
|
|
|
[grant.desktop]
|
|
path = "0:/os/desktop.elf"
|
|
effective = [
|
|
"power_request", "suspend", "process_admin", "storage_admin",
|
|
"raw_storage", "network_admin", "set_time", "user_admin",
|
|
"display_admin", "device_admin", "log_read",
|
|
]
|
|
delegable = [
|
|
"power_request", "suspend", "process_admin", "storage_admin",
|
|
"raw_storage", "network_admin", "set_time", "user_admin",
|
|
"display_admin", "device_admin", "log_read",
|
|
]
|
|
|
|
# The console session launchers. terminal.elf needs no authority of its own;
|
|
# it exists to pass the session's authority to the shell it hosts. The shell
|
|
# in turn exercises only power_request and suspend, but delegates on the same
|
|
# terms as the desktop so that the tools below work from a console. Both are
|
|
# clamped to the launching session: a standard session narrows this to
|
|
# power_request and suspend, and an unprivileged one to nothing.
|
|
[grant.terminal]
|
|
path = "0:/apps/terminal/terminal.elf"
|
|
delegable = ["all"]
|
|
|
|
[grant.shell]
|
|
path = "0:/os/shell.elf"
|
|
effective = ["power_request", "suspend"]
|
|
delegable = ["all"]
|
|
|
|
# ==== Settings and administrative applications ====
|
|
|
|
[grant.procmgr]
|
|
path = "0:/apps/procmgr/procmgr.elf"
|
|
effective = ["process_admin"]
|
|
|
|
# May restart the DHCP client, so it needs to pass network_admin on.
|
|
[grant.network]
|
|
path = "0:/apps/network/network.elf"
|
|
effective = ["network_admin"]
|
|
delegable = ["network_admin"]
|
|
|
|
[grant.display]
|
|
path = "0:/apps/display/display.elf"
|
|
effective = ["display_admin"]
|
|
|
|
[grant.disks]
|
|
path = "0:/apps/disks/disks.elf"
|
|
effective = ["storage_admin", "raw_storage"]
|
|
|
|
[grant.installer]
|
|
path = "0:/apps/installer/installer.elf"
|
|
effective = ["storage_admin", "raw_storage"]
|
|
|
|
[grant.timezone]
|
|
path = "0:/apps/timezone/timezone.elf"
|
|
effective = ["set_time"]
|
|
|
|
[grant.bluetooth]
|
|
path = "0:/apps/bluetooth/bluetooth.elf"
|
|
effective = ["device_admin"]
|
|
|
|
[grant.syslog]
|
|
path = "0:/apps/syslog/syslog.elf"
|
|
effective = ["log_read"]
|
|
|
|
[grant.sshserver]
|
|
path = "0:/apps/sshserver/sshserver.elf"
|
|
effective = ["user_admin"]
|
|
|
|
# ==== Console tools ====
|
|
|
|
[grant.ifconfig]
|
|
path = "0:/os/ifconfig.elf"
|
|
effective = ["network_admin"]
|
|
|
|
[grant.wifi]
|
|
path = "0:/os/wifi.elf"
|
|
effective = ["network_admin"]
|
|
|
|
[grant.sdr]
|
|
path = "0:/os/sdr.elf"
|
|
effective = ["device_admin"]
|