4

I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability.

On my ping binary, I have the CAP_NET_RAW capability set, and there is no setuid.

# CAP_NET_RAW is set
→ getcap `which ping`                                               
/bin/ping = cap_net_raw+ep

# There is no setuid
→ ls -l `which ping`                                                 
-rwxr-xr-x 1 root root 64424 Mar  9  2017 /bin/ping

# ping works...
→ ping -c 1 google.com                                               
PING google.com (172.217.6.46) 56(84) bytes of data.                                                  
64 bytes from sfo03s08-in-f14.1e100.net (172.217.6.46): icmp_seq=1 
ttl=54 time=11.9 ms                

--- google.com ping statistics ---                 
1 packets transmitted, 1 received, 0% packet loss, time 0ms                                           
rtt min/avg/max/mdev = 11.973/11.973/11.973/0.000 ms  

So why is it that I cannot ping from my user namespace?

→ ping google.com      
ping: socket: Operation not permitted 

→ capsh --print        
Current: = ...cap_net_raw...+ep                                                         
Bounding set =...cap_net_raw...                                                       
Securebits: 00/0x0/1'b0                            
secure-noroot: no (unlocked)                      
secure-no-suid-fixup: no (unlocked)               
secure-keep-caps: no (unlocked)                   
uid=0(root)                                        
gid=0(root)                                        

→ getcap `which ping`  
/bin/ping = cap_net_raw+ep      
  • Does not a process (context) have capabilities, not a file?! Sub-processes inherit it. – Ned64 Feb 9 '18 at 20:14
3

The child process created by clone(2) with the CLONE_NEWUSER flag starts out with a complete set of capabilities in the new user namespace. Likewise, a process that creates a new user namespace using unshare(2) or joins an existing user namespace using setns(2) gains a full set of capabilities in that namespace. On the other hand, that process has no capabilities in the parent (in the case of clone(2)) or previous (in the case of unshare(2) and setns(2)) user namespace, even if the new namespace is created or joined by the root user (i.e., a process with user ID 0 in the root namespace).

...

When a non-user-namespace is created, it is owned by the user namespace in which the creating process was a member at the time of the creation of the namespace. Actions on the non-user-namespace require capabilities in the corresponding user namespace.

-- http://man7.org/linux/man-pages/man7/user_namespaces.7.html

You can't get raw net access to network interfaces which you don't own!

$ unshare -r
# ping -c1 127.0.0.1
ping: socket: Operation not permitted

Compare:

$ unshare -rn
# ping -c1 127.0.0.1
connect: Network is unreachable
# ip link set dev lo up    # apparently the `lo` interface is pre-created.
# ping -c1 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.048 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.048/0.048/0.048/0.000 ms

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.