1

I'd like to set different capabilities to permitted and inherited sets of my file. Something like this:

sudo setcap cap_fsetid=ei mybinary
sudo setcap cap_kill=ep mybinary

However, the latter command overrides the former one. Is it even possible to can manage capabilities this way?

1 Answer 1

2

You can use getcap to get the list of currently set capabilities. Since these are whitespace separated you can add more like this:

sudo setcap first_capability=itsvalue executable_fname
sudo setcap "$(getcap executable_fname) newcap=value" executable_fname

(the capability list being whitespace separated: as cited in man setcap, that's described in man cap_from_text)

Caveat: querying before setting is not safe from race conditions – make sure no other process is concurrently setting capabilities.

If you know all capabilities at any given point in time, it's easier:

sudo setcap "first_capability=itsvalue newcap=value" executable_fname

In this context, + and = can be used to raise the capabilities. Using = here is easier to read, but there are some corner cases where + builds up state more predictably. Specifically where the listed capabilities for two different assignments have a common subset. For example these two are not equivalent:

$ sudo setcap "first=i second=p first,second=e" executable
$ sudo setcap "first=i second=p first,second+e" executable

The 2nd of them is equivalent to:

$ sudo setcap "first=ie second=pe" executable
5
  • = can only be used once in such a string. If you use it twice, the second one will override the first.
    – Tinkerer
    May 4, 2022 at 13:40
  • @Tinkerer, why is it so? I've tried to perform "sudo setcap "cap_fsetid=ei cap_kill=ep" mybinary" and getcap returns exactly what I expected "mybinary = cap_fsetid+ei cap_kill+ep". And your suggestion (sudo setcap "cap_fsetid=ei cap_kill+ep" mybinary) works the same way.
    – Ekaterina
    May 4, 2022 at 16:09
  • I'm going by the documentation which says = resets the state. But now that you mention it, I see that's only true of the listed capabilities on the left of the =. So, since the two entries are non-overlapping, it does as you say! Learned something. Thanks!
    – Tinkerer
    May 4, 2022 at 19:32
  • Happy to up vote again but I need you to edit in some way to unlock my downvote... Perhaps mention + as another method?
    – Tinkerer
    May 4, 2022 at 19:37
  • I've added some discussion. If that's approved, I'll be able to change my vote.
    – Tinkerer
    May 4, 2022 at 19:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .