Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [capabilities]

POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

14
votes
2answers
3k views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
13
votes
1answer
3k views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favorite scripting language to be able to ...
11
votes
8answers
5k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
10
votes
2answers
11k views

Unset `setcap` additional capabilities on excutable

An answer to Linux: allowing an user to listen to a port below 1024 specified giving an executable additional permissions using setcap such that the program could bind to ports <1024: setcap '...
10
votes
3answers
6k views

How do I use capsh: I am trying to run an unprivileged ping, with minimal capabilities

I am experimenting with capabilities, on Debian Gnu/Linux. I have copied /bin/ping to my current working directory. As expected it does not work, it was originally setuid root. I then give my ping ...
10
votes
2answers
3k views

When using setcap, where is the permission stored?

Using setcap to give additional permissions to a binary should write the new permission somewhere, on storage or in memory, where is it stored ? Using lsof as is doesn't work because the process ...
9
votes
1answer
5k views

'setcap' overwrites last capability. How do I set multiple capabilities?

I want to give node.js the ability to listen on port 80, and shutdown the computer. Initially I tried these two commands in sequence: setcap cap_net_bind_service=+ep /usr/bin/nodejs setcap ...
8
votes
1answer
3k views

Capabilities for a script on Linux

If I want to set a capability (capabilities(7)), such as CAP_NET_BIND_SERVICE, on an executable file and that file is a script, do I have to set the capability (setcap(8)) on the interpreter starting ...
7
votes
3answers
1k views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
6
votes
1answer
513 views

How do I run a process that wants to become root from a systemd service which is a regular user?

I have a service that I start using systemd. The service user and group are changed to a non-privileged user. [Service] ... User=regular_user Group=regular_user ... At some point the service needs ...
6
votes
1answer
17k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
6
votes
2answers
4k views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
6
votes
1answer
548 views

Can capabilities be specified in Debian packages?

Since RPM 4.7, there has been the ability to specify that a file in an RPM package should be installed with capabilities set (via %caps). Is there a similar feature for Debian packages?
6
votes
1answer
552 views

Why doesn't Ubuntu use capabilities on ping?

After running, $ ls -l /bin/ping -rwsr-xr-x 1 root root 34740 Nov 5 2012 /bin/ping I wonder, why doesn't Ubuntu use capabilities (i.e. raw sockets) rather than setuid?
5
votes
3answers
4k views

Which Linux capability do I need in order to write to /proc/sys/vm/drop_caches?

I am trying to clear my filesystem cache from inside a docker container, like so: docker run --rm ubuntu:vivid sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches" If I run this command I get sh: 1: ...
5
votes
2answers
5k views

Can you list iptables as a non-root user and why?

Is it at all possible to execute iptables --list …. command without being root? Running it as non-root prints this: $ iptables --list iptables v1.4.21: can't initialize iptables table `filter': ...
5
votes
1answer
3k views

How to replace setuid with file-system capabilities

Inspired by this question here is the follow-up: As some of you may know setuid-binaries are dangerous, since some exploits use these to escalate their rights up to root. Now it seems that there has ...
5
votes
1answer
479 views

Is setcap deprecated?

I'm starting a webserver as non-root using a systemd unit file. I am getting listen tcp :80: bind: permission denied even though I already ran setcap cap_net_bind_service=+ep on the executable. ...
5
votes
1answer
453 views

How to identify what capabilities are required for a command?

When I run a command within a docker container, I see: # ip netns exec 9ee961d90990 ifconfig setting the network namespace "9ee961d90990" failed: Operation not permitted I can launch my container ...
5
votes
1answer
786 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using popen(...
5
votes
1answer
280 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
4
votes
2answers
440 views

What does the “ep” capability mean?

root@macine:~# getcap ./some_bin ./some_bin =ep What does "ep" mean? What are the capabilities of this binary?
4
votes
2answers
213 views

Does macOS and Solaris have “capabilities”?

Linux have capabilities, which are used to give a non-root process some privileges. Does macOS and Solaris also have capabilities? if not, do they have something similar to capabilities?
4
votes
2answers
725 views

Why are not all permitted capabilities of a linux process effective all the time?

man 7 capabilities documents that the capabilities of a process on a linux box are recored a set of three masks: permitted effective inheritable I have an idea to what extend the inheritable mask ...
4
votes
1answer
253 views

Linux File Capabilities are lost when I modify the file. Is this expected behavior?

When I modify a file, the file capabilities I had set earlier are lost. Is this the expected behavior? I first set a file capability: $ setcap CAP_NET_RAW+ep ./test.txt $ getcap ./test.txt ./test....
4
votes
1answer
722 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
4
votes
1answer
565 views

Linux Capabilities with User Namespaces

I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability. ...
4
votes
1answer
3k views

How to read the /proc/<pid>/fd directory of a process, which has a linux capability?

As a non-root user I am running a process. The process binary has been given a cap_sys_resource capability. Even though the process is owned by the same user, that user cannot read its /proc//fd ...
4
votes
1answer
406 views

why is CAP_SYS_ADMIN needed for CLONE_NEWPID?

man 2 unshare tells us Use of CLONE_NEWPID requires the CAP_SYS_ADMIN capability and the suggested reading for further information man 7 pid_namespaces does not really discuss the presumable risk ...
3
votes
1answer
121 views

Why is CAP_NET_ADMIN insufficient permissions for ioctl(TUNSETIFF)?

I'm trying to write a tun/tap program in Rust. Since I don't want it to run as root I've added CAP_NET_ADMIN to the binary's capabilities: $sudo setcap cap_net_admin=eip target/release/tunnel $getcap ...
3
votes
1answer
134 views

Ping not working in a new C container

I've been working on writing my own Linux container from scratch in C. I've borrowed code from several places and put up a basic version with namespaces & cgroups. Basically, I clone a new ...
3
votes
2answers
7k views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
3
votes
0answers
229 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
3
votes
0answers
153 views

setcap on dhclient appears to have no effect

I'm having a rather frustrating time getting dhclient to run from a normal user using setcap. Because of the environment I am working with, adding to sudoers is not an option. My attempt: sudo ...
3
votes
1answer
152 views

Why can't a UID 0 process hardlink to SUID files in a user namespace?

Consider the following transcript of a user-namespaced shell running with root privileges (UID 0 within the namespace, unprivileged outside): # cat /proc/$$/status | grep CapEff CapEff: ...
3
votes
1answer
137 views

Replacement for cap-bound

We have an old Linux from scratch kernel used in one of our systems, that uses the old cap-bound mechanism (modifying /proc/sys/kernel/cap-bound) to restrict the capabilities of the system. This was ...
2
votes
1answer
9k views

How to install Linux capabilities like setcap and getcap?

In my openSUSE 13.2 machine I can apply commands like setcap and getcap on some application. I moved that application to an openSUSE 12 machine that does not have capabilities installed. In the 13.2 ...
2
votes
1answer
312 views

How does Magisk on Android work as su without setuid and capabilities?

I've read in another answer that on Android the su binaries avoid needing to be setuid by using filesystem capabilities like cap_setuid. But then I tried to check this, and to my surprise, I found no ...
2
votes
1answer
3k views

How to see if a file has CAP_NET_ADMIN?

I ran the following command: sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip `which nmap` Now I'd like to add to my ~/.zshrc a line that detects such settings and exports ...
2
votes
2answers
1k views

Is it possible to specify groups in /etc/security/capability.conf?

I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to non-...
2
votes
0answers
210 views

Can capabilities for files be specified via cmake/cpack?

Since RPM 4.7, there has been the ability to specify that a file in an RPM package should be installed with capabilities set (via %caps). Is there a way to specify something like this via cmake/cpack ...
1
vote
2answers
155 views

How shall we understand the rules of capabilities with respect to exec()?

From The Linux Programming Interface: The permitted set is a limiting superset for the capabilities that can be added to the effective and inheritable sets. Does it mean that the permitted set ...
1
vote
3answers
73 views

Does a process that have the root user always have all of the capabilities available in Linux?

In Linux, a process that have a non-root user can have some capabilities assigned to it to increase its privileges. And a process that have the root user have all of the capabilities available, but ...
1
vote
1answer
83 views

What properties of an unprivileged process are preserved during an `execve` call?

I am teaching an Operating Systems course and trying to wrap my mind around the fork/execve technique for creating new processes. My current understanding is that a fork make a complete copy of the ...
1
vote
1answer
1k views

Set hostname without root, and without CAP_SYS_ADMIN

I have an application that I want to be able to change the hostname in Linux. Currently doing so by running the hostname command. I don't want to set CAP_SYS_ADMIN either. I also don't want to edit ...
1
vote
2answers
479 views

Can't get upstart service to honor capabilities(7)

I am developing a daemon started by upstart (Ubuntu 14.04) which needs to run as a non-privileged user (for security), but bind privileged port 443. I am using setcap to set the CAP_NET_BIND_SERVICE ...
1
vote
1answer
129 views

Why do I get permission denied when using unshare?

I'm exploring the namespace feature of linux kernel, using Archlinux. But I got some message that I can't explain the reason, could anyone explain them to me? xtricman⚓ArchVirtual⏺️~🤐export LANG=...
1
vote
1answer
797 views

Trying to disable some Bluetooth features on RPi3

I'm trying to make my RPi3 to be a bluetooth sink. My problem is that when I'm trying to connect my Windows 7 Laptop to my RPi Bluetooth sink, it is displayed like that : Sorry, it's in french. It ...
1
vote
1answer
107 views

Access /proc/pid/ns/net without running query process as root?

In a program I'm enumerating network namespaces by scanning /proc/pid/ for ns/net links. This program runs inside the "root" namespaces (original init) of the host itself. Normally, I need to run the ...
1
vote
1answer
785 views

How to run smartctl as root without switching to root?

I have this C code that runs smartctl command and takes its output: #include <iostream> #include <cstdio> #include <cstdlib> using namespace std; int main() { cout << "...