Questions tagged [capabilities]

POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

Filter by
Sorted by
Tagged with
10
votes
2answers
3k views

When using setcap, where is the permission stored?

Using setcap to give additional permissions to a binary should write the new permission somewhere, on storage or in memory, where is it stored ? Using lsof as is doesn't work because the process ...
15
votes
3answers
3k views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
1
vote
0answers
39 views

htop - how can I enable the new metrics for “delay accounting”?

htop has some new metrics: PERCENT_CPU_DELAY (CPUD%) The percentage of time spent waiting for a CPU (while runnable). Requires CAP_NET_ADMIN. PERCENT_IO_DELAY (IOD%)...
0
votes
0answers
49 views

Run a single process that can fork and clone as a non-root-user

I wish to run a docker container which runs a single os process, forks a clone of itself through invoking '/proc/self/exe'. This process will be launched by a user of the container, who may be a ...
4
votes
2answers
587 views

What does the “ep” capability mean?

root@macine:~# getcap ./some_bin ./some_bin =ep What does "ep" mean? What are the capabilities of this binary?
5
votes
1answer
820 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using popen(...
0
votes
0answers
78 views

Capabilities to start a systemd service

I'm starting a process with the cap_kill capability and use this process to kill other services. However I'd like to be able to restart these service with a systemctl restart xxx Is there a ...
0
votes
1answer
48 views

setcap binary but with arguments?

I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark: root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground ...
1
vote
1answer
160 views

Why do I get permission denied when using unshare?

I'm exploring the namespace feature of linux kernel, using Archlinux. But I got some message that I can't explain the reason, could anyone explain them to me? xtricman⚓ArchVirtual⏺️~🤐export LANG=...
0
votes
1answer
366 views

Docker running an app with NET_ADMIN capability: involved risks

I'm trying to run an app in a docker container.The app requires root privileges to run. sudo docker run --restart always --network host --cap-add NET_ADMIN -d -p 53:53/udp my-image My question is: ...
3
votes
1answer
301 views

Why is CAP_NET_ADMIN insufficient permissions for ioctl(TUNSETIFF)?

I'm trying to write a tun/tap program in Rust. Since I don't want it to run as root I've added CAP_NET_ADMIN to the binary's capabilities: $sudo setcap cap_net_admin=eip target/release/tunnel $getcap ...
1
vote
1answer
54 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
0
votes
0answers
70 views

Give root's permission to restricted user using PAM and Linux capabilities

I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities. I try this: ...
4
votes
2answers
252 views

Does macOS and Solaris have “capabilities”?

Linux have capabilities, which are used to give a non-root process some privileges. Does macOS and Solaris also have capabilities? if not, do they have something similar to capabilities?
1
vote
1answer
88 views

Can you assign Linux capabilities to users?

In Solaris, I believe that you can assign privileges to users. I know that in Linux you can assign capabilities to executable files, but can you also assign capabilities to users?
1
vote
3answers
88 views

Does a process that have the root user always have all of the capabilities available in Linux?

In Linux, a process that have a non-root user can have some capabilities assigned to it to increase its privileges. And a process that have the root user have all of the capabilities available, but ...
0
votes
0answers
27 views

Better use ACL or Capability to let users start a service?

My question is openned to other propositions too. An install sequence puts a binary in the directories (say bin1 in PATH_TO_BIN1). It configures a service in /etc/init.d The service has to be ...
0
votes
1answer
65 views

Difference between running a process as root and running process with all the linux capabilities

I have a docker container which runs perfectly fine in a kubernetes pod when privileged:true is set in the specification. But when I run the same docker container, by giving all the linux capabilities,...
13
votes
1answer
3k views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favorite scripting language to be able to ...
3
votes
1answer
143 views

Replacement for cap-bound

We have an old Linux from scratch kernel used in one of our systems, that uses the old cap-bound mechanism (modifying /proc/sys/kernel/cap-bound) to restrict the capabilities of the system. This was ...
3
votes
1answer
205 views

Ping not working in a new C container

I've been working on writing my own Linux container from scratch in C. I've borrowed code from several places and put up a basic version with namespaces & cgroups. Basically, I clone a new ...
3
votes
0answers
320 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
5
votes
1answer
665 views

Is setcap deprecated?

I'm starting a webserver as non-root using a systemd unit file. I am getting listen tcp :80: bind: permission denied even though I already ran setcap cap_net_bind_service=+ep on the executable. ...
0
votes
0answers
48 views

What is the “Securebits:” in capsh --print

I ran capsh --print inside a container and saw this: Securebits: 00/0x0/1'b0 secure-noroot: no (unlocked) secure-no-suid-fixup: no (unlocked) secure-keep-caps: no (unlocked) What is Securebit ...
1
vote
0answers
49 views

Does every syscall require at most 1 capability on Linux?

I am trying to understand the relationship between capabilities and syscalls on Linux. As far as I know, the capabilities of a process are only ever considered when that process calls a syscall. When ...
0
votes
1answer
403 views

Error with setcap CAP_SYS_TIME+ep /user/mybinaryprogram

I'm trying to use the capabilities (CAP_SYS_TIME) but when I run this command: setcap CAP_SYS_TIME+ep /user/mybinaryprogram on my system, I get the following error: Failed to set capabilities ...
2
votes
1answer
95 views

What properties of an unprivileged process are preserved during an `execve` call?

I am teaching an Operating Systems course and trying to wrap my mind around the fork/execve technique for creating new processes. My current understanding is that a fork make a complete copy of the ...
1
vote
2answers
164 views

How shall we understand the rules of capabilities with respect to exec()?

From The Linux Programming Interface: The permitted set is a limiting superset for the capabilities that can be added to the effective and inheritable sets. Does it mean that the permitted set ...
5
votes
1answer
290 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
7
votes
3answers
1k views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
2
votes
1answer
364 views

How does Magisk on Android work as su without setuid and capabilities?

I've read in another answer that on Android the su binaries avoid needing to be setuid by using filesystem capabilities like cap_setuid. But then I tried to check this, and to my surprise, I found no ...
2
votes
2answers
1k views

Is it possible to specify groups in /etc/security/capability.conf?

I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to non-...
1
vote
1answer
923 views

Trying to disable some Bluetooth features on RPi3

I'm trying to make my RPi3 to be a bluetooth sink. My problem is that when I'm trying to connect my Windows 7 Laptop to my RPi Bluetooth sink, it is displayed like that : Sorry, it's in french. It ...
5
votes
1answer
505 views

How to identify what capabilities are required for a command?

When I run a command within a docker container, I see: # ip netns exec 9ee961d90990 ifconfig setting the network namespace "9ee961d90990" failed: Operation not permitted I can launch my container ...
1
vote
1answer
122 views

Access /proc/pid/ns/net without running query process as root?

In a program I'm enumerating network namespaces by scanning /proc/pid/ for ns/net links. This program runs inside the "root" namespaces (original init) of the host itself. Normally, I need to run the ...
4
votes
1answer
433 views

why is CAP_SYS_ADMIN needed for CLONE_NEWPID?

man 2 unshare tells us Use of CLONE_NEWPID requires the CAP_SYS_ADMIN capability and the suggested reading for further information man 7 pid_namespaces does not really discuss the presumable risk ...
4
votes
1answer
613 views

Linux Capabilities with User Namespaces

I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability. ...
0
votes
0answers
20 views

Granting service specific capabilities

I have a sm-t365 rooted tablet. I've created a service in the init.rc file that all it does is create a folder in /data (which requires root), it works if in my service in init.rc i specify user root.....
7
votes
1answer
19k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
11
votes
3answers
6k views

How do I use capsh: I am trying to run an unprivileged ping, with minimal capabilities

I am experimenting with capabilities, on Debian Gnu/Linux. I have copied /bin/ping to my current working directory. As expected it does not work, it was originally setuid root. I then give my ping ...
5
votes
2answers
5k views

Can you list iptables as a non-root user and why?

Is it at all possible to execute iptables --list …. command without being root? Running it as non-root prints this: $ iptables --list iptables v1.4.21: can't initialize iptables table `filter': ...
0
votes
1answer
361 views

Systemd and AmbientCapabilities: debugging “Invalid argument” error

I am running Arch Linux. My problem originally manifested with Caddy web server, but it is not limited to it. Thus I have a simple unit to troubleshoot with a random binary (capsh): [Service] ...
5
votes
3answers
4k views

Which Linux capability do I need in order to write to /proc/sys/vm/drop_caches?

I am trying to clear my filesystem cache from inside a docker container, like so: docker run --rm ubuntu:vivid sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches" If I run this command I get sh: 1: ...
3
votes
1answer
3k views

How to read the /proc/<pid>/fd directory of a process, which has a linux capability?

As a non-root user I am running a process. The process binary has been given a cap_sys_resource capability. Even though the process is owned by the same user, that user cannot read its /proc//fd ...
11
votes
8answers
5k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
11
votes
2answers
11k views

Unset `setcap` additional capabilities on excutable

An answer to Linux: allowing an user to listen to a port below 1024 specified giving an executable additional permissions using setcap such that the program could bind to ports <1024: setcap '...
3
votes
0answers
161 views

setcap on dhclient appears to have no effect

I'm having a rather frustrating time getting dhclient to run from a normal user using setcap. Because of the environment I am working with, adding to sudoers is not an option. My attempt: sudo ...
6
votes
1answer
565 views

How do I run a process that wants to become root from a systemd service which is a regular user?

I have a service that I start using systemd. The service user and group are changed to a non-privileged user. [Service] ... User=regular_user Group=regular_user ... At some point the service needs ...
4
votes
1answer
747 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
1
vote
1answer
790 views

Find out what capabilities a process needs

I want to allow run zfs zpool commands without root and sudo. I suppose that I need to give some capabilities to user, but how to get list of capabilities needed by some particular command? The OS is ...