In Solaris, I believe that you can assign privileges to users.
I know that in Linux you can assign capabilities to executable files, but can you also assign capabilities to users?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityYes, it is possible to give additional capabilities to processes running as non-root users in Linux, which can be useful to allow these users to run a non-setuid ping
binary, or to run servers that bind to a privileged port (< 1024).
In many cases, you will need ambient capabilities support for this to work correctly, so you might need to use a recent kernel and libraries to unlock all the features needed to make capabilities useful as a non-root user.
(You can also use inheritable capabilities, but that requires you to mark the binaries to be executed with matching file capabilities, using setcap
.)
An example of using capsh(1) to run a non-setuid ping as a non-root user would be:
sudo capsh --caps="cap_net_raw+eip cap_setpcap,cap_setuid,cap_setgid+ep" \
--keep=1 --user=nobody --addamb=cap_net_raw -- \
-c "./ping -c1 127.0.0.1"
Note that you need capsh and libcap version 2.25+ (for --addamb
) and Linux kernel 4.3+ for the support of ambient capabilities. See this question for more details (the source for the command above.)
Note that you need sudo
for the command above (since only root can add capabilities) but by the time ping
gets executed, the user has been dropped to "nobody", so ping
itself never gets to run with full root privileges, only with cap_net_raw.
Another situation in which capabilities can be useful is to launch a daemon. For example, running an HTTP server on port 80, without having to launch it as root and have it drop privileges only after binding to the port.
systemd offers directives for configuring capabilities on service units, and it can also run a process as non-root by configuring an User=
for the service. For the case of running processes as a non-root user with extra capabilities, you may need ambient capabilities support as well, which will require Linux kernel 4.3+.