Does BSD have priveleges or capabilities?

Question

In Solaris, I believe that you can assign privileges to users, and in Linux you can assign capabilities to executable files.

Does some or all BSD flavors have privileges or capabilities, or something of this nature? or do they follow the "all or nothing" approach where the root user have full privileges while the other users have very few privileges?

Answer 1

Note that Linux is pretty much the odd one out in calling these things "capabilities". They are not the concept of capabilities as in capability-based operating systems. Other operating systems tend to call them something else.

In FreeBSD, as in some other operating systems, they are called privileges. FreeBSD people replaced the old suser() mechanism in its kernel code with a system of roughly 400 such privileges, ranging from the privilege to reboot the system to the privilege to attach to a jail, back in 2006.

They are in part under the control of Mandatory Access Control modules, such as mac_biba and mac_lowa. For such a fine-grained system, though, what comes out of the box is fairly basic.

This is not to be confused with FreeBSD's capsicum, which is more like, albeit not totally the same as, a capabilities system. But it isn't what you are asking about.

NetBSD also replaced the old suser() mechanism with a clone of the MacOS 10 KAuth mechanism, also back in 2006. Again there is a system of separate privileges, ranging from adjusting the system time to running mknod(). There are not quite as many as FreeBSD has, but there are a fair few.

Again, different plug-in so-called "secmodels" control exactly how the privileges are set up. And again, the set of secmodels that comes out of the box is fairly basic.

OpenBSD today still has the old suser() mechanism and has not split up the privileges of the superuser.

Further reading

• Marshall Kirk McKusick, George V. Neville-Neil, and Robert N.M. Watson (2014). "Security". The Design and Implementation of the FreeBSD Operating System. 2nd Edition. Addison-Wesley Professional. ISBN 9780133761832. pp. 157 et seq.
• Robert Watson (2006). "TrustedBSD priv(9)". FreeBSD Quarterly Status Report 2006-10–2006-12.
• maclabel. FreeBSD Miscellaneous Information Manual. 2002-10-25.
• Elad Efrat (2011-12-04). secmodel. NetBSD Kernel Developer's Manual.