POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

learn more… | top users | synonyms

9
votes
1answer
1k views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favouite scripting language to be able to ...
3
votes
1answer
277 views

Why doesn't Ubuntu use capabilities on ping?

After running, $ ls -l /bin/ping -rwsr-xr-x 1 root root 34740 Nov 5 2012 /bin/ping I wonder, why doesn't Ubuntu use capabilities (i.e. raw sockets) rather than setuid?
1
vote
1answer
270 views

Principle of least privilege: Does Authbind helper really need setuid root, or can it run with cap_net_bind_services?

Does Authbind's helper really need setuid root, or can it run with the CAP_NET_BIND_SERVICES capability and still work?
3
votes
0answers
84 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
2
votes
0answers
140 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using popen(...
2
votes
0answers
42 views

Replacement for cap-bound

We have an old Linux from scratch kernel used in one of our systems, that uses the old cap-bound mechanism (modifying /proc/sys/kernel/cap-bound) to restrict the capabilities of the system. This was ...
2
votes
0answers
81 views

Can capabilities for files be specified via cmake/cpack?

Since RPM 4.7, there has been the ability to specify that a file in an RPM package should be installed with capabilities set (via %caps). Is there a way to specify something like this via cmake/cpack ...
1
vote
0answers
230 views

How to set local shared library path after setting file capabilities on Debian?

I have a custom application which comes with its own libstdc++.so.6 and it requires cap_net_admin and cap_net_raw to work properly. Before I set file capabilities it starts without problems but when I ...
1
vote
0answers
34 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
0
votes
0answers
72 views

Linux capabilities for java to resolve symbolic links

I run a java program by a non-root user. The program has to resolve a symlink to the real file name, but the link is owned by a different non-root user. I used setcap to set capabilities to open root-...
0
votes
0answers
58 views

Fedora 14 root missing capability

I am trying to run a process that performs a clone() operation using a set of flags (CLONE_NEWIPC, CLONE_NEWNET, ...) that require CAP_SYS_ADMIN capability. This should not be a problem since I am ...