POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

learn more… | top users | synonyms

0
votes
0answers
8 views

Linux capabilities for java to resolve symbolic links

I run a java program by a non-root user. The program has to resolve a symlink to the real file name, but the link is owned by a different non-root user. I used setcap to set capabilities to open ...
6
votes
1answer
719 views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favouite scripting language to be able to ...
2
votes
0answers
16 views

Replacement for cap-bound

We have an old Linux from scratch kernel used in one of our systems, that uses the old cap-bound mechanism (modifying /proc/sys/kernel/cap-bound) to restrict the capabilities of the system. This was ...
2
votes
0answers
46 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
0
votes
0answers
12 views

Is the functionality of libipset covered by CAP_NET_ADMIN?

The capabilities(7) states (excerpt): CAP_NET_ADMIN Perform various network-related operations: * interface configuration; * administration of IP firewall, masquerading, and accounting; ...
13
votes
2answers
1k views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
2
votes
2answers
90 views

Which Linux capability do I need in order to write to /proc/sys/vm/drop_caches?

I am trying to clear my filesystem cache from inside a docker container, like so: docker run --rm ubuntu:vivid sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches" If I run this command I get sh: 1: ...
1
vote
1answer
86 views

How to see if a file has CAP_NET_ADMIN?

I ran the following command: sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip `which nmap` Now I'd like to add to my ~/.zshrc a line that detects such settings and exports ...
1
vote
1answer
534 views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
2
votes
1answer
177 views

How do I use capsh: I am trying to run an unprivileged ping, with minimal capabilities

I am experimenting with capabilities, on Debian Gnu/Linux. I have copied /bin/ping to my current working directory. As expected it does not work, it was originally setuid root. I then give my ping ...
0
votes
0answers
567 views

How to install Linux capabilities like setcap and getcap?

In my openSUSE 13.2 machine I can apply commands like setcap and getcap on some application. I moved that application to an openSUSE 12 machine that does not have capabilities installed. In the 13.2 ...
1
vote
1answer
93 views

How to run smartctl as root without switching to root?

I have this C code that runs smartctl command and takes its output: #include <iostream> #include <cstdio> #include <cstdlib> using namespace std; int main() { cout << ...
1
vote
1answer
177 views

Set hostname without root, and without CAP_SYS_ADMIN

I have an application that I want to be able to change the hostname in Linux. Currently doing so by running the hostname command. I don't want to set CAP_SYS_ADMIN either. I also don't want to edit ...
2
votes
1answer
372 views

'setcap' overwrites last capability. How do I set multiple capabilities?

I want to give node.js the ability to listen on port 80, and shutdown the computer. Initially I tried these two commands in sequence: setcap cap_net_bind_service=+ep /usr/bin/nodejs setcap ...
2
votes
1answer
89 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
1
vote
0answers
143 views

How to set local shared library path after setting file capabilities on Debian?

I have a custom application which comes with its own libstdc++.so.6 and it requires cap_net_admin and cap_net_raw to work properly. Before I set file capabilities it starts without problems but when I ...
2
votes
0answers
51 views

Can capabilities for files be specified via cmake/cpack?

Since RPM 4.7, there has been the ability to specify that a file in an RPM package should be installed with capabilities set (via %caps). Is there a way to specify something like this via cmake/cpack ...
3
votes
1answer
99 views

Can capabilities be specified in Debian packages?

Since RPM 4.7, there has been the ability to specify that a file in an RPM package should be installed with capabilities set (via %caps). Is there a similar feature for Debian packages?
1
vote
0answers
30 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
3
votes
1answer
186 views

Why doesn't Ubuntu use capabilities on ping?

After running, $ ls -l /bin/ping -rwsr-xr-x 1 root root 34740 Nov 5 2012 /bin/ping I wonder, why doesn't Ubuntu use capabilities (i.e. raw sockets) rather than setuid?
1
vote
2answers
156 views

Can't get upstart service to honor capabilities(7)

I am developing a daemon started by upstart (Ubuntu 14.04) which needs to run as a non-privileged user (for security), but bind privileged port 443. I am using setcap to set the CAP_NET_BIND_SERVICE ...
4
votes
2answers
577 views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
6
votes
3answers
476 views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
1
vote
1answer
169 views

Principle of least privilege: Does Authbind helper really need setuid root, or can it run with cap_net_bind_services?

Does Authbind's helper really need setuid root, or can it run with the CAP_NET_BIND_SERVICES capability and still work?
0
votes
0answers
56 views

Fedora 14 root missing capability

I am trying to run a process that performs a clone() operation using a set of flags (CLONE_NEWIPC, CLONE_NEWNET, ...) that require CAP_SYS_ADMIN capability. This should not be a problem since I am ...
6
votes
1answer
584 views

Capabilities for a script on Linux

If I want to set a capability (capabilities(7)), such as CAP_NET_BIND_SERVICE, on an executable file and that file is a script, do I have to set the capability (setcap(8)) on the interpreter starting ...
2
votes
1answer
552 views

Is it possible to specify groups in /etc/security/capability.conf?

I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to ...
8
votes
9answers
1k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
3
votes
1answer
1k views

How to replace setuid with file-system capabilities

Inspired by this question here is the follow-up: As some of you may know setuid-binaries are dangerous, since some exploits use these to escalate their rights up to root. Now it seems that there has ...