The capabilities tag has no wiki summary.
2
votes
1answer
71 views
Is it possible to specify groups in /etc/security/capability.conf?
I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to ...
5
votes
9answers
256 views
How to prevent a process from writing files
I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
3
votes
1answer
175 views
How to replace setuid with file-system capabilities
Inspired by this question here is the follow-up:
As some of you may know setuid-binaries are dangerous, since some exploits use these to escalate their rights up to root.
Now it seems that there has ...
2
votes
0answers
204 views
Can capabilities be used in scripts without setcap'ing the interpreter binary?
Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf.
Now I just need to set cap_net_bind_service+i on the interpreter of my favouite scripting language to be able to ...
