I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability.
On my ping binary, I have the CAP_NET_RAW capability set, and there is no setuid.
# CAP_NET_RAW is set → getcap `which ping` /bin/ping = cap_net_raw+ep # There is no setuid → ls -l `which ping` -rwxr-xr-x 1 root root 64424 Mar 9 2017 /bin/ping # ping works... → ping -c 1 google.com PING google.com (220.127.116.11) 56(84) bytes of data. 64 bytes from sfo03s08-in-f14.1e100.net (18.104.22.168): icmp_seq=1 ttl=54 time=11.9 ms --- google.com ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 11.973/11.973/11.973/0.000 ms
So why is it that I cannot ping from my user namespace?
→ ping google.com ping: socket: Operation not permitted → capsh --print Current: = ...cap_net_raw...+ep Bounding set =...cap_net_raw... Securebits: 00/0x0/1'b0 secure-noroot: no (unlocked) secure-no-suid-fixup: no (unlocked) secure-keep-caps: no (unlocked) uid=0(root) gid=0(root) → getcap `which ping` /bin/ping = cap_net_raw+ep