I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to non-root users. Doing this by adding the relevant capabilities (
+ei, issue is moot with
setcap and configure my personal user account (
jdavis4) to have those capabilities assigned to its session at login via
pam_cap.so and it's been going smashingly. I can give individual users access to "ping" and "kill" via capability.conf
The problem I'm having, though, is that it occurred to me that if this were a production system an administrator would probably want to assign capabilities by some sort of aggregate unit so that they don't have to do this for each individual user every time they make one. This way a user can just be added to the "filesystemAdmin" group and get stuff like
CAP_DAC_OVERRIDE or added to "ProcessManagement" and getting stuff like
Is this currently possible?