Questions tagged [setcap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
100 views

How to use tcpdump safely (-Z option vs file capabilities / setcap)?

I am evaluating, how tcpdump can be used in a safer manner with as few as possible privileges. Two possibilities: 1. -Z option If tcpdump is running as root, after opening the capture device or input ...
2
votes
1answer
134 views

Why ping works without capability and setuid [duplicate]

I learned from here that there's 2 ways to control privileged activities: setuid and capability. But when I'm playing around with ping on my machine, it seems that it can bypass these 2 mechanism. ...
0
votes
1answer
371 views

Should I grant sudo to a user or add CAP_SYS_ADMIN capabilities to use nvprof/ncu? And why?

Since CUDA 10.1, users are required to have sudo privileges to collect advanced metrics with cuda profiling tools such as nvprof or nsight compute (ncu). Alternatives to get around it are described ...
0
votes
0answers
167 views

How to setcap wifi-menu on arch for non-root users?

I'm trying to run wifi-menu on arch as non-root. No setcap i've tried works. [root@lilegg johny]# setcap CAP_NET_ADMIN,CAP_SYS_ADMIN,CAP_NET_RAW,CAP_DAC_OVERRIDE=eip /usr/bin/wifi-menu [root@lilegg ...
4
votes
0answers
88 views

Is there something like 'sudo' but give only one capability not real root?

I want to run a one-time web server on port 80, which I will never run again. Is there something like 'sudo' that gives only temporary CAP_NET_BIND_SERVICE, not real root, to a process? So that we ...
1
vote
0answers
122 views

After setcap on executable, curl_easy_perform throws out of memory error

I've cross compiled an executable to run on Debian Stretch that requires a specific version of cURL (greater than 7.56) to run, and needs specific capabilities during execution. So on the executable ...
0
votes
1answer
983 views

setcap binary but with arguments?

I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark: root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground ...
1
vote
1answer
268 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
0
votes
2answers
352 views

Why sudo isn't acceptable?

I need to create a network bridge with 'brctl addbr br-lan' command in a sh script without using sudo. I have a script like; brctl addbr br-lan ifconfig lo up I have tried to set capabilities to my ...
9
votes
1answer
3k views

Is setcap deprecated?

I'm starting a webserver as non-root using a systemd unit file. I am getting listen tcp :80: bind: permission denied even though I already ran setcap cap_net_bind_service=+ep on the executable. ...
17
votes
2answers
17k views

Setcap not found in Debian 9

I'm using a installation scripts that needs setcap and it's not found. What package contains it? libcap2 is already installed.
1
vote
0answers
582 views

setcap settings do not reflect in getcap

root@localhost:~# setcap cap_net_raw+p /bin/ping root@localhost:~# getcap /bin/ping root@localhost:~# ls -l $(which ping) -rwsr-xr-x. 1 root root 34752 Nov 8 2014 /bin/ping root@localhost:~# ping ...
14
votes
1answer
45k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
13
votes
2answers
5k views

When using setcap, where is the permission stored?

Using setcap to give additional permissions to a binary should write the new permission somewhere, on storage or in memory, where is it stored ? Using lsof as is doesn't work because the process ...
1
vote
2answers
778 views

Where during booting are capabilities retrieved

I want a node application to have the ability to bind to low number ports (443 to be precise, since its an http2 server). I do this with sudo setcap cap_net_bind_service=+ep /path/to/node This is ...
1
vote
1answer
2k views

Set hostname without root, and without CAP_SYS_ADMIN

I have an application that I want to be able to change the hostname in Linux. Currently doing so by running the hostname command. I don't want to set CAP_SYS_ADMIN either. I also don't want to edit ...
11
votes
1answer
7k views

'setcap' overwrites last capability. How do I set multiple capabilities?

I want to give node.js the ability to listen on port 80, and shutdown the computer. Initially I tried these two commands in sequence: setcap cap_net_bind_service=+ep /usr/bin/nodejs setcap ...
4
votes
1answer
936 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
9
votes
2answers
6k views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
0
votes
2answers
2k views

setcap for rhel5

A quick question: I am not able to find much info to run setcap on rhel5 . I searched few packages in my system # yum install libcap Loaded plugins: product-id, security, subscription-...
3
votes
3answers
112 views

possibility of running daemons with under privileged users during bootup

I have an authoritative DNS daemon in my test DNS setup which is responsible to provide host IP at best choice. This daemon/process can run by setting some capabilities using setcap and then a ...
3
votes
1answer
1k views

One non-root user run jetty by port 512 which less that port1024

Customer asks us to create a non-root user to run our web system which bind port 512, less than 1024. When web server(jetty) runs, this is the exception: 2013-10-16 14:49:51.406:WARN::failed Server@...
11
votes
2answers
15k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap returns ...
15
votes
1answer
4k views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favorite scripting language to be able to ...
14
votes
6answers
22k views

How can I set up a remote port forward on port 80 to my localhost with the help of setcap?

I'd like to accept connections briefly for development when I'm NATed, and so I'm attempting to do this: $ ssh ubuntu@example.org -R 80:localhost:80 Which fails as I'm trying to bind a port that is ...