capabilities.7: Update securebits discussion to use SECBIT_* flags

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

diff --git a/man7/capabilities.7 b/man7/capabilities.7
index 158ecadc55bd9bc1088759e41f0dddb65ec35662..3cc394d56549d8b7ab2ec2172a4021cc70065af0 100644 (file)
--- a/man7/capabilities.7
+++ b/man7/capabilities.7
@@ -42,7 +42,7 @@
 .\"     capability, then we must also set the effective flag for all
 .\"     other capabilities where the permitted or inheritable bit is set.
 .\"
-.TH CAPABILITIES 7 2009-08-03 "Linux" "Linux Programmer's Manual"
+.TH CAPABILITIES 7 2010-01-31 "Linux" "Linux Programmer's Manual"
 .SH NAME
 capabilities \- overview of Linux capabilities
 .SH DESCRIPTION
@@ -778,7 +778,7 @@ flags that can be used to disable special handling of capabilities for UID 0
 .RI ( root ).
 These flags are as follows:
 .TP
-.B SECURE_KEEP_CAPS
+.B SECBIT_KEEP_CAPS
 Setting this flag allows a thread that has one or more 0 UIDs to retain
 its capabilities when it switches all of its UIDs to a nonzero value.
 If this flag is not set,
@@ -790,14 +790,14 @@ This flag is always cleared on an
 .B PR_SET_KEEPCAPS
 operation.)
 .TP
-.B SECURE_NO_SETUID_FIXUP
+.B SECBIT_NO_SETUID_FIXUP
 Setting this flag stops the kernel from adjusting  capability sets when
 the threads's effective and file system UIDs are switched between
 zero and nonzero values.
 (See the subsection
 .IR "Effect of User ID Changes on Capabilities" .)
 .TP
-.B SECURE_NOROOT
+.B SECBIT_NOROOT
 If this bit is set, then the kernel does not grant capabilities
 when a set-user-ID-root program is executed, or when a process with
 an effective or real UID of 0 calls
@@ -810,10 +810,10 @@ Setting any of the "locked" flags is irreversible,
 and has the effect of preventing further changes to the
 corresponding "base" flag.
 The locked flags are:
-.BR SECURE_KEEP_CAPS_LOCKED ,
-.BR SECURE_NO_SETUID_FIXUP_LOCKED ,
+.BR SECBIT_KEEP_CAPS_LOCKED ,
+.BR SECBIT_NO_SETUID_FIXUP_LOCKED ,
 and
-.BR SECURE_NOROOT_LOCKED .
+.BR SECBIT_NOROOT_LOCKED .
 .PP
 The
 .I securebits
@@ -844,11 +844,11 @@ is by executing a program with associated file capabilities:
 .nf
 
 prctl(PR_SET_SECUREBITS,
-        1 << SECURE_KEEP_CAPS_LOCKED |
-        1 << SECURE_NO_SETUID_FIXUP |
-        1 << SECURE_NO_SETUID_FIXUP_LOCKED |
-        1 << SECURE_NOROOT |
-        1 << SECURE_NOROOT_LOCKED);
+        SECBIT_KEEP_CAPS_LOCKED |
+        SECBIT_NO_SETUID_FIXUP |
+        SECBIT_NO_SETUID_FIXUP_LOCKED |
+        SECBIT_NOROOT |
+        SECBIT_NOROOT_LOCKED);
 .fi
 .in
 .SH "CONFORMING TO"