Can you assign Linux capabilities to users?

Question

In Solaris, I believe that you can assign privileges to users.

I know that in Linux you can assign capabilities to executable files, but can you also assign capabilities to users?

Answer 1

Yes, it is possible to give additional capabilities to processes running as non-root users in Linux, which can be useful to allow these users to run a non-setuid ping binary, or to run servers that bind to a privileged port (< 1024).

In many cases, you will need ambient capabilities support for this to work correctly, so you might need to use a recent kernel and libraries to unlock all the features needed to make capabilities useful as a non-root user.

(You can also use inheritable capabilities, but that requires you to mark the binaries to be executed with matching file capabilities, using setcap.)

An example of using capsh(1) to run a non-setuid ping as a non-root user would be:

sudo capsh --caps="cap_net_raw+eip cap_setpcap,cap_setuid,cap_setgid+ep" \
    --keep=1 --user=nobody --addamb=cap_net_raw -- \
    -c "./ping -c1 127.0.0.1"

Note that you need capsh and libcap version 2.25+ (for --addamb) and Linux kernel 4.3+ for the support of ambient capabilities. See this question for more details (the source for the command above.)

Note that you need sudo for the command above (since only root can add capabilities) but by the time ping gets executed, the user has been dropped to "nobody", so ping itself never gets to run with full root privileges, only with cap_net_raw.

Another situation in which capabilities can be useful is to launch a daemon. For example, running an HTTP server on port 80, without having to launch it as root and have it drop privileges only after binding to the port.

systemd offers directives for configuring capabilities on service units, and it can also run a process as non-root by configuring an User= for the service. For the case of running processes as a non-root user with extra capabilities, you may need ambient capabilities support as well, which will require Linux kernel 4.3+.