Where during booting are capabilities retrieved

Question

I want a node application to have the ability to bind to low number ports (443 to be precise, since its an http2 server).

I do this with sudo setcap cap_net_bind_service=+ep /path/to/node

This is apparently remembered over a boot. I am using nvm to allow me to have different versions of node installed, and I have just upgraded the version and of course I no longer bind.

It is easy enough to add the capability again, but presumably somewhere I am accumulating permissions which I ought to switch off on older versions of node.

But I can't find out where in the boot sequence this happens. Can someone tell me where (I am running Debian).

EDIT

I think the info should be stored within the extra attributes of the executable. However, I can't find any extra attributes on the files I have set up this way.

Answer 1

The capabilities are stored with the file entry in the directory (more precisely, they're in the file's inode, like other kinds of permissions). Nothing special happens during boot.

As of GNU coreutils 8.23, the ls command doesn't know about Linux capabilities, so you won't find anything in its output to tell you that a program has capabilities set. Use the getcap command to list capabilities.

To clear all capabilities from a file, use setcap -r /path/to/file. You don't have anything to clean up, though — the capabilities are stored with the file, there's nothing to do beyond removing the file.

Answer 2

See setcap(8), capabilities are set for the executable file. This works similar to (but with finer granularity than) SUID or SGID. Nowhere in "the booting process" is this handled; whenever the file is executed as a program, the resulting process gets the capabilities.

Yes, leaving old versions of the file with elevated privileges is a serious security risk, better delete the old versions whenever a new one is installed.