I am trying to grant a user the CAP_NET_ADMIN and CAP_NET_RAW capabilities on a Debian 11 system running the GNOME3 desktop environment. The user should receive the ability to use these capabilities upon logging in through the graphical login.

My /etc/security/capabilities.conf:

cap_net_admin,cap_net_raw       myuser
none                            *   

I have added the following to the top of gdm-launch-environment, gdm-password, and to the bottom of common-auth (as directed in man pam_cap) in /etc/pam.d with no luck:

auth    optional    pam_cap.so

The result:

myuser@host$ /sbin/capsh --print
Current: =
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read
Ambient set =

It works, however, if I add the line to the top of the pam su file and su to my user. I have done this setup successfully using LXDE by making a similar change, so I'm sure this is possible here as well.

How can I configure PAM to grant the capabilities when logging in through GDM?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.