Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [capabilities]

POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

10
votes
3answers
6k views

How do I use capsh: I am trying to run an unprivileged ping, with minimal capabilities

I am experimenting with capabilities, on Debian Gnu/Linux. I have copied /bin/ping to my current working directory. As expected it does not work, it was originally setuid root. I then give my ping ...
11
votes
8answers
5k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
1
vote
1answer
83 views

What properties of an unprivileged process are preserved during an `execve` call?

I am teaching an Operating Systems course and trying to wrap my mind around the fork/execve technique for creating new processes. My current understanding is that a fork make a complete copy of the ...
14
votes
2answers
3k views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
6
votes
1answer
17k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
6
votes
2answers
4k views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
5
votes
2answers
5k views

Can you list iptables as a non-root user and why?

Is it at all possible to execute iptables --list …. command without being root? Running it as non-root prints this: $ iptables --list iptables v1.4.21: can't initialize iptables table `filter': ...
6
votes
1answer
552 views

Why doesn't Ubuntu use capabilities on ping?

After running, $ ls -l /bin/ping -rwsr-xr-x 1 root root 34740 Nov 5 2012 /bin/ping I wonder, why doesn't Ubuntu use capabilities (i.e. raw sockets) rather than setuid?
8
votes
1answer
3k views

Capabilities for a script on Linux

If I want to set a capability (capabilities(7)), such as CAP_NET_BIND_SERVICE, on an executable file and that file is a script, do I have to set the capability (setcap(8)) on the interpreter starting ...
6
votes
1answer
513 views

How do I run a process that wants to become root from a systemd service which is a regular user?

I have a service that I start using systemd. The service user and group are changed to a non-privileged user. [Service] ... User=regular_user Group=regular_user ... At some point the service needs ...
3
votes
1answer
3k views

How to read the /proc/<pid>/fd directory of a process, which has a linux capability?

As a non-root user I am running a process. The process binary has been given a cap_sys_resource capability. Even though the process is owned by the same user, that user cannot read its /proc//fd ...
0
votes
0answers
26 views

Run a single process that can fork and clone as a non-root-user

I wish to run a docker container which runs a single os process, forks a clone of itself through invoking '/proc/self/exe'. This process will be launched by a user of the container, who may be a ...