POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

learn more… | top users | synonyms

6
votes
1answer
721 views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favouite scripting language to be able to ...
3
votes
1answer
187 views

Why doesn't Ubuntu use capabilities on ping?

After running, $ ls -l /bin/ping -rwsr-xr-x 1 root root 34740 Nov 5 2012 /bin/ping I wonder, why doesn't Ubuntu use capabilities (i.e. raw sockets) rather than setuid?
1
vote
1answer
169 views

Principle of least privilege: Does Authbind helper really need setuid root, or can it run with cap_net_bind_services?

Does Authbind's helper really need setuid root, or can it run with the CAP_NET_BIND_SERVICES capability and still work?
2
votes
0answers
16 views

Replacement for cap-bound

We have an old Linux from scratch kernel used in one of our systems, that uses the old cap-bound mechanism (modifying /proc/sys/kernel/cap-bound) to restrict the capabilities of the system. This was ...
2
votes
0answers
47 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
2
votes
0answers
51 views

Can capabilities for files be specified via cmake/cpack?

Since RPM 4.7, there has been the ability to specify that a file in an RPM package should be installed with capabilities set (via %caps). Is there a way to specify something like this via cmake/cpack ...
1
vote
0answers
143 views

How to set local shared library path after setting file capabilities on Debian?

I have a custom application which comes with its own libstdc++.so.6 and it requires cap_net_admin and cap_net_raw to work properly. Before I set file capabilities it starts without problems but when I ...
1
vote
0answers
30 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
0
votes
0answers
17 views

Linux capabilities for java to resolve symbolic links

I run a java program by a non-root user. The program has to resolve a symlink to the real file name, but the link is owned by a different non-root user. I used setcap to set capabilities to open ...
0
votes
0answers
12 views

Is the functionality of libipset covered by CAP_NET_ADMIN?

The capabilities(7) states (excerpt): CAP_NET_ADMIN Perform various network-related operations: * interface configuration; * administration of IP firewall, masquerading, and accounting; ...
0
votes
0answers
583 views

How to install Linux capabilities like setcap and getcap?

In my openSUSE 13.2 machine I can apply commands like setcap and getcap on some application. I moved that application to an openSUSE 12 machine that does not have capabilities installed. In the 13.2 ...
0
votes
0answers
56 views

Fedora 14 root missing capability

I am trying to run a process that performs a clone() operation using a set of flags (CLONE_NEWIPC, CLONE_NEWNET, ...) that require CAP_SYS_ADMIN capability. This should not be a problem since I am ...