Questions tagged [setcap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
79 views

Reproduce setcap behavior with capsh

There is a non-capability-aware program that requires at least 1) cap_sys_admin and 2) either cap_dac_override or cap_dac_read_search. This can be proven as follows: sudo setcap 'all=ep cap_sys_admin-...
2 votes
1 answer
580 views

how to set capabilities (setcap) on perf

I'd like to use the perf utility. I was following instructions to set up a privileged group of users who are permitted to execute performance monitoring and observability without limits (as instructed ...
1 vote
1 answer
1k views

How to use tcpdump safely (-Z option vs file capabilities / setcap)?

I am evaluating, how tcpdump can be used in a safer manner with as few as possible privileges. Two possibilities: 1. -Z option If tcpdump is running as root, after opening the capture device or input ...
  • 155
5 votes
1 answer
2k views

Why ping works without capability and setuid [duplicate]

I learned from here that there's 2 ways to control privileged activities: setuid and capability. But when I'm playing around with ping on my machine, it seems that it can bypass these 2 mechanism. ...
  • 175
2 votes
1 answer
2k views

Should I grant sudo to a user or add CAP_SYS_ADMIN capabilities to use nvprof/ncu? And why?

Since CUDA 10.1, users are required to have sudo privileges to collect advanced metrics with cuda profiling tools such as nvprof or nsight compute (ncu). Alternatives to get around it are described ...
  • 183
0 votes
0 answers
247 views

How to setcap wifi-menu on arch for non-root users?

I'm trying to run wifi-menu on arch as non-root. No setcap i've tried works. [root@lilegg johny]# setcap CAP_NET_ADMIN,CAP_SYS_ADMIN,CAP_NET_RAW,CAP_DAC_OVERRIDE=eip /usr/bin/wifi-menu [root@lilegg ...
  • 333
4 votes
0 answers
231 views

Is there something like 'sudo' but give only one capability not real root?

I want to run a one-time web server on port 80, which I will never run again. Is there something like 'sudo' that gives only temporary CAP_NET_BIND_SERVICE, not real root, to a process? So that we ...
1 vote
0 answers
195 views

After setcap on executable, curl_easy_perform throws out of memory error

I've cross compiled an executable to run on Debian Stretch that requires a specific version of cURL (greater than 7.56) to run, and needs specific capabilities during execution. So on the executable ...
  • 111
0 votes
1 answer
2k views

setcap binary but with arguments?

I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark: root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground ...
  • 36.9k
1 vote
2 answers
446 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
  • 281
0 votes
2 answers
563 views

Why sudo isn't acceptable?

I need to create a network bridge with 'brctl addbr br-lan' command in a sh script without using sudo. I have a script like; brctl addbr br-lan ifconfig lo up I have tried to set capabilities to my ...
  • 125
12 votes
1 answer
5k views

Is setcap deprecated?

I'm starting a webserver as non-root using a systemd unit file. I am getting listen tcp :80: bind: permission denied even though I already ran setcap cap_net_bind_service=+ep on the executable. ...
  • 960
20 votes
2 answers
26k views

Setcap not found in Debian 9

I'm using a installation scripts that needs setcap and it's not found. What package contains it? libcap2 is already installed.
  • 493
0 votes
0 answers
892 views

setcap settings do not reflect in getcap

root@localhost:~# setcap cap_net_raw+p /bin/ping root@localhost:~# getcap /bin/ping root@localhost:~# ls -l $(which ping) -rwsr-xr-x. 1 root root 34752 Nov 8 2014 /bin/ping root@localhost:~# ping ...
  • 101
27 votes
1 answer
72k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
15 votes
2 answers
7k views

When using setcap, where is the permission stored?

Using setcap to give additional permissions to a binary should write the new permission somewhere, on storage or in memory, where is it stored ? Using lsof as is doesn't work because the process ...
  • 844
1 vote
2 answers
988 views

Where during booting are capabilities retrieved

I want a node application to have the ability to bind to low number ports (443 to be precise, since its an http2 server). I do this with sudo setcap cap_net_bind_service=+ep /path/to/node This is ...
  • 331
1 vote
1 answer
2k views

Set hostname without root, and without CAP_SYS_ADMIN

I have an application that I want to be able to change the hostname in Linux. Currently doing so by running the hostname command. I don't want to set CAP_SYS_ADMIN either. I also don't want to edit ...
19 votes
2 answers
8k views

'setcap' overwrites last capability. How do I set multiple capabilities?

I want to give node.js the ability to listen on port 80, and shutdown the computer. Initially I tried these two commands in sequence: setcap cap_net_bind_service=+ep /usr/bin/nodejs setcap ...
4 votes
1 answer
1k views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
9 votes
2 answers
7k views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
1 vote
2 answers
2k views

setcap for rhel5

A quick question: I am not able to find much info to run setcap on rhel5 . I searched few packages in my system # yum install libcap Loaded plugins: product-id, security, subscription-...
  • 449
3 votes
3 answers
256 views

possibility of running daemons with under privileged users during bootup

I have an authoritative DNS daemon in my test DNS setup which is responsible to provide host IP at best choice. This daemon/process can run by setting some capabilities using setcap and then a ...
  • 449
3 votes
1 answer
1k views

One non-root user run jetty by port 512 which less that port1024

Customer asks us to create a non-root user to run our web system which bind port 512, less than 1024. When web server(jetty) runs, this is the exception: 2013-10-16 14:49:51.406:WARN::failed Server@...
  • 31
11 votes
2 answers
17k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap returns ...
  • 1,288
17 votes
1 answer
5k views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favorite scripting language to be able to ...
  • 2,227
18 votes
6 answers
29k views

How can I set up a remote port forward on port 80 to my localhost with the help of setcap?

I'd like to accept connections briefly for development when I'm NATed, and so I'm attempting to do this: $ ssh ubuntu@example.org -R 80:localhost:80 Which fails as I'm trying to bind a port that is ...
  • 4,254