Does the root
user bypass capability checking in the kernel, or is the root
user subject to capability checking starting with Linux 2.2?
May applications check for and deny access for the root
user, if certain capabilities are dropped from its capability set?
By default the root user has a full set of capabilities.
The reason I'm asking is the following except from man capabilities
:
Privileged processes bypass all kernel permission checks
However, nothing is said whether this rule still holds after Linux 2.2 release.
Extra: Docker removes certain capabilities from the root user while starting a new container. However, Docker doesn't use user namespaces by default, so how is the root
user's capabilities restored?
man capabilities
:
For the purpose of performing permission checks, traditional UNIX implementations distinguish two categories of processes: privileged processes (whose effective user ID is 0, referred to as superuser or root), and unprivileged processes (whose effective UID is nonzero). Privileged processes bypass all kernel permission checks, while unprivileged processes are subject to full permission checking based on the process's credentials (usually: effective UID, effective GID, and supplementary group list).
Starting with kernel 2.2, Linux divides the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled and disabled. Capabilities are a per-thread attribute.