The tag has no wiki summary.

learn more… | top users | synonyms

12
votes
1answer
551 views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
7
votes
9answers
751 views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
6
votes
3answers
400 views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
6
votes
1answer
217 views

Capabilities for a script on Linux

If I want to set a capability (capabilities(7)), such as CAP_NET_BIND_SERVICE, on an executable file and that file is a script, do I have to set the capability (setcap(8)) on the interpreter starting ...
4
votes
0answers
427 views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favouite scripting language to be able to ...
3
votes
1answer
575 views

How to replace setuid with file-system capabilities

Inspired by this question here is the follow-up: As some of you may know setuid-binaries are dangerous, since some exploits use these to escalate their rights up to root. Now it seems that there has ...
3
votes
0answers
38 views

Why doesn't Ubuntu use capabilities on ping?

After running, $ ls -l /bin/ping -rwsr-xr-x 1 root root 34740 Nov 5 2012 /bin/ping I wonder, why doesn't Ubuntu use capabilities (i.e. raw sockets) rather than setuid?
3
votes
2answers
85 views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
2
votes
1answer
341 views

Is it possible to specify groups in /etc/security/capability.conf?

I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to ...
1
vote
2answers
34 views

Can't get upstart service to honor capabilities(7)

I am developing a daemon started by upstart (Ubuntu 14.04) which needs to run as a non-privileged user (for security), but bind privileged port 443. I am using setcap to set the CAP_NET_BIND_SERVICE ...
1
vote
1answer
70 views

Principle of least privilege: Does Authbind helper really need setuid root, or can it run with cap_net_bind_services?

Does Authbind's helper really need setuid root, or can it run with the CAP_NET_BIND_SERVICES capability and still work?
1
vote
0answers
157 views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
1
vote
1answer
690 views

setcap error on Debian Squeeze: “unable to set CAP_SETFCAP effective capability: Operation not permitted”

My python script needs at least the CAP_NET_RAW capability, because it's using a pcap library, but I don't want to use sudo (and in fact sudo causes my script to not work properly, with the script's ...
0
votes
0answers
48 views

Fedora 14 root missing capability

I am trying to run a process that performs a clone() operation using a set of flags (CLONE_NEWIPC, CLONE_NEWNET, ...) that require CAP_SYS_ADMIN capability. This should not be a problem since I am ...