I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities.

I try this:

  1. Add module pam_cap.so in /etc/security/su:

    # %PAM-1.0     
    auth        optional    pam_cap.so
    auth        sufficient  pam_rootok.so
  2. Create file /etc/security/capability.conf and add allowed capabilities for user:

    cap_sys_admin,cap_dac_override myuser
    * none
  3. Then I run the following su command:

    $ su - myuser

    I can verify this user's capabilities using:

    $ capsh --print

As I understand for root's permissions it's also necessary to set capability bit for programs in /bin. For example, if myuser will delete files in which root is owner, I can set cap bit on /bin/rm:

sudo setcap 'CAP_DAC_OVERRIDE+ei' /bin/rm

But in this case its necessary to set different kinds of capabilities on all programs in /bin. And it's not good way.

Is it possible give root's permissions to user in just one step, setting some required capabilities? For example, its may be setting cap bit only on user's shell?

  • Capabilities are assigned to processes, not users, and you can't tell the kernel "on any transition of real/effective UID of the process to this specific UID (e.g. 1000), grant this process the following capabilities"), so any solution here will only be a partial workaround and may be suitable or not depending on what you need. Specifically, in case of PAM-related workaround, any UID transition bypassing PAM (e.g. a process calling setuid() directly) will not give the expected result. – Danila Kiver Mar 12 at 17:54
  • @DanilaKiver Thanx for the explanation. – Alexey Mar 13 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.