Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [setcap]

The tag has no usage guidance.

1
vote
0answers
15 views

After setcap on executable, curl_easy_perform throws out of memory error

I've cross compiled an executable to run on Debian Stretch that requires a specific version of cURL (greater than 7.56) to run, and needs specific capabilities during execution. So on the executable ...
0
votes
1answer
27 views

setcap binary but with arguments?

I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark: root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground ...
1
vote
1answer
33 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
0
votes
2answers
82 views

Why sudo isn't acceptable?

I need to create a network bridge with 'brctl addbr br-lan' command in a sh script without using sudo. I have a script like; brctl addbr br-lan ifconfig lo up I have tried to set capabilities to my ...
5
votes
1answer
474 views

Is setcap deprecated?

I'm starting a webserver as non-root using a systemd unit file. I am getting listen tcp :80: bind: permission denied even though I already ran setcap cap_net_bind_service=+ep on the executable. ...
12
votes
2answers
5k views

Setcap not found in Debian 9

I'm using a installation scripts that needs setcap and it's not found. What package contains it? libcap2 is already installed.
0
votes
0answers
193 views

setcap settings do not reflect in getcap

root@localhost:~# setcap cap_net_raw+p /bin/ping root@localhost:~# getcap /bin/ping root@localhost:~# ls -l $(which ping) -rwsr-xr-x. 1 root root 34752 Nov 8 2014 /bin/ping root@localhost:~# ping ...
6
votes
1answer
16k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
10
votes
2answers
3k views

When using setcap, where is the permission stored?

Using setcap to give additional permissions to a binary should write the new permission somewhere, on storage or in memory, where is it stored ? Using lsof as is doesn't work because the process ...
1
vote
2answers
509 views

Where during booting are capabilities retrieved

I want a node application to have the ability to bind to low number ports (443 to be precise, since its an http2 server). I do this with sudo setcap cap_net_bind_service=+ep /path/to/node This is ...
1
vote
1answer
1k views

Set hostname without root, and without CAP_SYS_ADMIN

I have an application that I want to be able to change the hostname in Linux. Currently doing so by running the hostname command. I don't want to set CAP_SYS_ADMIN either. I also don't want to edit ...
9
votes
1answer
5k views

'setcap' overwrites last capability. How do I set multiple capabilities?

I want to give node.js the ability to listen on port 80, and shutdown the computer. Initially I tried these two commands in sequence: setcap cap_net_bind_service=+ep /usr/bin/nodejs setcap ...
4
votes
1answer
721 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
6
votes
2answers
4k views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
0
votes
2answers
1k views

setcap for rhel5

A quick question: I am not able to find much info to run setcap on rhel5 . I searched few packages in my system # yum install libcap Loaded plugins: product-id, security, subscription-...
3
votes
3answers
95 views

possibility of running daemons with under privileged users during bootup

I have an authoritative DNS daemon in my test DNS setup which is responsible to provide host IP at best choice. This daemon/process can run by setting some capabilities using setcap and then a ...
3
votes
1answer
989 views

One non-root user run jetty by port 512 which less that port1024

Customer asks us to create a non-root user to run our web system which bind port 512, less than 1024. When web server(jetty) runs, this is the exception: 2013-10-16 14:49:51.406:WARN::failed Server@...
10
votes
1answer
13k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap returns ...
13
votes
1answer
3k views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favorite scripting language to be able to ...
7
votes
4answers
14k views

How can I set up a remote port forward on port 80 to my localhost with the help of setcap?

I'd like to accept connections briefly for development when I'm NATed, and so I'm attempting to do this: $ ssh ubuntu@example.org -R 80:localhost:80 Which fails as I'm trying to bind a port that is ...