Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [capabilities]

POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

5
votes
1answer
786 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using popen(...
5
votes
1answer
280 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
4
votes
1answer
406 views

why is CAP_SYS_ADMIN needed for CLONE_NEWPID?

man 2 unshare tells us Use of CLONE_NEWPID requires the CAP_SYS_ADMIN capability and the suggested reading for further information man 7 pid_namespaces does not really discuss the presumable risk ...
3
votes
1answer
137 views

Replacement for cap-bound

We have an old Linux from scratch kernel used in one of our systems, that uses the old cap-bound mechanism (modifying /proc/sys/kernel/cap-bound) to restrict the capabilities of the system. This was ...
1
vote
1answer
33 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
1
vote
1answer
767 views

Find out what capabilities a process needs

I want to allow run zfs zpool commands without root and sudo. I suppose that I need to give some capabilities to user, but how to get list of capabilities needed by some particular command? The OS is ...
1
vote
1answer
485 views

Principle of least privilege: Does Authbind helper really need setuid root, or can it run with cap_net_bind_services?

Does Authbind's helper really need setuid root, or can it run with the CAP_NET_BIND_SERVICES capability and still work?
0
votes
1answer
54 views

Difference between running a process as root and running process with all the linux capabilities

I have a docker container which runs perfectly fine in a kubernetes pod when privileged:true is set in the specification. But when I run the same docker container, by giving all the linux capabilities,...
3
votes
0answers
229 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
3
votes
0answers
154 views

setcap on dhclient appears to have no effect

I'm having a rather frustrating time getting dhclient to run from a normal user using setcap. Because of the environment I am working with, adding to sudoers is not an option. My attempt: sudo ...
2
votes
0answers
210 views

Can capabilities for files be specified via cmake/cpack?

Since RPM 4.7, there has been the ability to specify that a file in an RPM package should be installed with capabilities set (via %caps). Is there a way to specify something like this via cmake/cpack ...
1
vote
0answers
29 views

htop - how can I enable the new metrics for “delay accounting”?

htop has some new metrics: PERCENT_CPU_DELAY (CPUD%) The percentage of time spent waiting for a CPU (while runnable). Requires CAP_NET_ADMIN. PERCENT_IO_DELAY (IOD%)...
1
vote
0answers
41 views

Does every syscall require at most 1 capability on Linux?

I am trying to understand the relationship between capabilities and syscalls on Linux. As far as I know, the capabilities of a process are only ever considered when that process calls a syscall. When ...
1
vote
0answers
750 views

How to set local shared library path after setting file capabilities on Debian?

I have a custom application which comes with its own libstdc++.so.6 and it requires cap_net_admin and cap_net_raw to work properly. Before I set file capabilities it starts without problems but when I ...
1
vote
0answers
73 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
0
votes
0answers
26 views

Run a single process that can fork and clone as a non-root-user

I wish to run a docker container which runs a single os process, forks a clone of itself through invoking '/proc/self/exe'. This process will be launched by a user of the container, who may be a ...
0
votes
0answers
39 views

Capabilities to start a systemd service

I'm starting a process with the cap_kill capability and use this process to kill other services. However I'd like to be able to restart these service with a systemctl restart xxx Is there a ...
0
votes
0answers
47 views

Give root's permission to restricted user using PAM and Linux capabilities

I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities. I try this: ...
0
votes
0answers
23 views

Better use ACL or Capability to let users start a service?

My question is openned to other propositions too. An install sequence puts a binary in the directories (say bin1 in PATH_TO_BIN1). It configures a service in /etc/init.d The service has to be ...
0
votes
0answers
28 views

What is the “Securebits:” in capsh --print

I ran capsh --print inside a container and saw this: Securebits: 00/0x0/1'b0 secure-noroot: no (unlocked) secure-no-suid-fixup: no (unlocked) secure-keep-caps: no (unlocked) What is Securebit ...
0
votes
0answers
19 views

Granting service specific capabilities

I have a sm-t365 rooted tablet. I've created a service in the init.rc file that all it does is create a folder in /data (which requires root), it works if in my service in init.rc i specify user root.....
0
votes
0answers
269 views

Linux capabilities for java to resolve symbolic links

I run a java program by a non-root user. The program has to resolve a symlink to the real file name, but the link is owned by a different non-root user. I used setcap to set capabilities to open root-...
0
votes
0answers
82 views

Fedora 14 root missing capability

I am trying to run a process that performs a clone() operation using a set of flags (CLONE_NEWIPC, CLONE_NEWNET, ...) that require CAP_SYS_ADMIN capability. This should not be a problem since I am ...