1

I tried adding cap_sys_admin permissions to user myroot.

For this, I added these lines to /etc/security/capabilities:

cap_sys_admin myroot
none *

and this line to /etc/pam.d/su:

auth            required        pam_cap.so

But user myroot doesn't have these permissions.

What can I do to add these permissions to my user?

5

I believe the file is called /etc/security/capability.conf not /etc/security/capabilities. I was able to get this working like so:

$ cat /etc/security/capability.conf
cap_sys_admin   user1

And then adding pam_cap.so to PAM. NOTE: It's imperative that pam_cap.so come before the pam_rootok.so line.

$ cat /etc/pam.d/su
#%PAM-1.0
auth        optional    pam_cap.so
auth        sufficient  pam_rootok.so
...
...

Example

Here with the above in place if I run the following su command:

$ su - user1

I can verify this user's capabilities:

$ capsh --print
Current: = cap_sys_admin+i
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,35,36
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
uid=1001(user1)
gid=1001(user1)
groups=1001(user1)

The key line in that output:

Current: = cap_sys_admin+i

Packages

This was done on a CentOS 7.x box. I had these packages installed pertaining to capabilities:

$ rpm -qa | grep libcap
libcap-ng-utils-0.7.5-4.el7.x86_64
libcap-2.22-9.el7.x86_64
libcap-ng-0.7.5-4.el7.x86_64

They provide the following useful tools when dealing with capabilities:

$ rpm -ql libcap-ng-utils | grep /bin/
/usr/bin/captest
/usr/bin/filecap
/usr/bin/netcap
/usr/bin/pscap

$ rpm -ql libcap | grep /sbin/
/usr/sbin/capsh
/usr/sbin/getcap
/usr/sbin/getpcaps
/usr/sbin/setcap

NOTE: See the respective man pages for these tools if you need more info on their usage.

References

  • 1
    Tnx a lot! It solved my problem! – Win32Sector Jul 12 '18 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.