The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
20 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
3
votes
2answers
164 views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
0
votes
1answer
198 views

setcap fo rhel5

A quick question , I am not able to find much info to run setcap on rhel5 . I searched few packages in my system # yum install libcap Loaded plugins: product-id, security, ...
3
votes
3answers
44 views

possibilty of running deamons with under privilaged users while bootup

I have authoritative DNS daemon in my test DNS setup. which is responsible to provide host IP at best choice. Anyway this daemon/process can run by setting some capabilities using setcap and then a ...
3
votes
1answer
326 views

One non-root user run jetty by port 512 which less that port1024

Customer asks us to create a non-root user to run our web system which bind port 512, less than 1024. When web server(jetty) runs, this is the exception: 2013-10-16 14:49:51.406:WARN::failed ...
4
votes
1answer
2k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap ...
6
votes
1answer
489 views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favouite scripting language to be able to ...
6
votes
2answers
3k views

How can I set up a remote port forward on port 80 to my localhost with the help of setcap?

I'd like to accept connections briefly for development when I'm NATed, and so I'm attempting to do this: $ ssh ubuntu@example.org -R 80:localhost:80 Which fails as I'm trying to bind a port that is ...