0

I have a file (let's call it prog) that has the cap_setfcap capabiility. Can I use it to grant prog (the file itself) full capabilities? I know it's not recommended, I just want to know if it can be done.

EDIT: To clarify: I want to grant prog ALL the capabilities that the system has (all sets). I get it that the file can grant himself full "file capabilities", the question is can he grant himself full "run-time capabilities" as well?

Thanks for all the help!

3
  • You probably have to clarify your question, as there are many sets of capabilities, and it is not clear, in which set you have CAP_SETFCAP for the file and what do you mean exactly by "granting prog full capabilities" - do you mean run-time capabilities or file capabilities? Which set? Nov 25 '20 at 19:05
  • Anyway, AFAIR, you cannot guarantee that this program will have the full effective capability set in the runtime, as this may be limited by dropping some caps from the bounding set (e.g. systemd may drop some caps for some service, and if your binary with a full sets file capabilities will be ran by this service, only those caps which are in the bounding set of this service will be available in the process' effective set for your program, or even less). Nov 25 '20 at 19:11
  • 1
    I updated the question @DanilaKiver and added more clarity.
    – Harel
    Nov 26 '20 at 9:53
0

Yes.

If you write a program that wants to grant file capabilities to anything without also containing code that performs sanity checks or some form of authentication, you can. (Programmers can write code to do all sorts of things.)

In fact, /sbin/setcap is such a program:

$ cp /sbin/setcap ./easycap
$ chmod go-rwx ./easycap
$ sudo ./easycap cap_setfcap=p ./easycap
$ ./easycap =ep ./easycap
$ /sbin/getcap ./easycap
easycap =ep

Unlike setuid-root programs that can also do the same thing, here, the chmod go-rwx ./easycap restricts access to this powerful binary to just the whoami user.

To grant this program the cap_setfcap capability, the program has to get it from somewhere. In this case, the sudo user is granting this binary permission to give any file capability to any binary it can write to.

That is, it is the sudo invoker who thinks this whole arrangement is a good idea. Done this way, or on a single user system, this might be really handy for an admin that understands all the ways this could be abused. In other, more likely, situations this might not be such a great idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.