.TH CAP 3.SH NAMEcap \- capability for changing user name.SH SYNOPSIS.BI "bind #¤ " dir.PP.IB dir /caphash.br.IB dir /capuse.SH DESCRIPTION.I Capallows a process owned by the host owner (see.IR eve (10.2))to give another process on the same machinea capability to set its user name to a specified user.The capability is a string of the form:.IP[.IB fromuser @].IB touser @ key.PPwhere.I fromuseris a process's current user name,.I touseris its new user name, and.I keyis a string of random characters(eg, produced by.IR security-random (2))..PP.B Caphashis a write-only file that can only be opened by the host owner.A process enables the use of a capability by writing the keyed hash of.IB fromuser @ touserto.BR caphash .The hash is computed using.B Keyring->hmac_sha1as follows:.IP.EXkr := load Keyring Keyring->PATH;IPint: import kr;users := sys->sprint("%s@%s", fromuser, touser);cap := sys->sprint("%s@%s", users, key);digest := array[Keyring->SHA1dlen] of byte;ausers := array of byte users;kr->hmac_sha1(ausers, len ausers, array of byte key, digest, nil);if(sys->write(caphashfd, digest, len digest) < 0)	error();.EE.PPThe capability (eg,.B capin the example)can then be passed to another process..PP.B Capuseis a write-only file that can be opened by any process.It can then write a capability string to change its user name,provided that capability has previously been enabled by the host owner via.BR caphash ,and if the capability included a.IR fromuser ,the writing process currently has that user name.After a successful write, the writing process will be owned by.IR touser .Any capability can be used at most once..PPA capability enabled by.B caphashhas a limited lifetime, on the order of 30 seconds..B Caphashcan be removed by the host owner to prevent its further use..SH SOURCE.B /emu/port/devcap.c.br.B /os/port/devcap.c.SH SEE ALSO.IR keyring-sha1 (2),.IR cons (3),.IR intro (5),.IR eve (10.2).SH DIAGNOSTICSA write to.B capusewithout a previous write to.B caphashsets the error string to.RB `` "invalid capability" ''.