Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf.
Now I just need to set cap_net_bind_service+i on the interpreter of my favouite scripting language to be able to add CAP_NET_BIND_SERVICE to the effective set via libcap[-ng].

This works fine, but I wonder if there's a way to achieve the same thing without setting any caps to the interpreter binary. While it's not a big problem (other user accounts don't have the cap so they can't use it even with the bit set on the interpreter binary) it's somewhat annoying since I have to re-set the flag everytime the interpreter is updated.

share|improve this question

1 Answer 1

Usually, the capabilities are inherited to the children. As stated in the manpage :

A child created via fork(2) inherits copies of its parent's capability sets.

The issue with the scripts is they are not executables. Your calling program (usually the shell) has to check the first line for a shebang, then call the real interpreter (set in the shebang) with your script as argument.

This mean you'll have to set the capability on the interpreter, not on the script. The same thing applies to suid bits, and other special flags.

So either you make a copy of your interpreter, set the capabilities you want on it (also check that nobody can access it through chmod/chown), and call this copied interpreter in your shebang. You also may do the setcap logic in your script.

share|improve this answer
    
Ok, didn't saw the question was asked 2 years ago but never closed... Also, seems like a duplicate of unix.stackexchange.com/questions/87348/… –  Adrien M. Oct 24 at 14:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.