Questions tagged [setcap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
372 views

Reproduce setcap behavior with capsh

There is a non-capability-aware program that requires at least 1) cap_sys_admin and 2) either cap_dac_override or cap_dac_read_search. This can be proven as follows: sudo setcap 'all=ep cap_sys_admin-...
PlushBeaver's user avatar
3 votes
2 answers
2k views

how to set capabilities (setcap) on perf

I'd like to use the perf utility. I was following instructions to set up a privileged group of users who are permitted to execute performance monitoring and observability without limits (as instructed ...
levente.nas's user avatar
1 vote
1 answer
5k views

How to use tcpdump safely (-Z option vs file capabilities / setcap)?

I am evaluating, how tcpdump can be used in a safer manner with as few as possible privileges. Two possibilities: 1. -Z option If tcpdump is running as root, after opening the capture device or input ...
A_blop's user avatar
  • 165
6 votes
1 answer
8k views

Why ping works without capability and setuid [duplicate]

I learned from here that there's 2 ways to control privileged activities: setuid and capability. But when I'm playing around with ping on my machine, it seems that it can bypass these 2 mechanism. ...
zingdle's user avatar
  • 185
2 votes
1 answer
3k views

Should I grant sudo to a user or add CAP_SYS_ADMIN capabilities to use nvprof/ncu? And why?

Since CUDA 10.1, users are required to have sudo privileges to collect advanced metrics with cuda profiling tools such as nvprof or nsight compute (ncu). Alternatives to get around it are described ...
nico's user avatar
  • 183
0 votes
0 answers
343 views

How to setcap wifi-menu on arch for non-root users?

I'm trying to run wifi-menu on arch as non-root. No setcap i've tried works. [root@lilegg johny]# setcap CAP_NET_ADMIN,CAP_SYS_ADMIN,CAP_NET_RAW,CAP_DAC_OVERRIDE=eip /usr/bin/wifi-menu [root@lilegg ...
johny why's user avatar
  • 371
4 votes
0 answers
367 views

Is there something like 'sudo' but give only one capability not real root?

I want to run a one-time web server on port 80, which I will never run again. Is there something like 'sudo' that gives only temporary CAP_NET_BIND_SERVICE, not real root, to a process? So that we ...
Bob Johnson's user avatar
1 vote
0 answers
245 views

After setcap on executable, curl_easy_perform throws out of memory error

I've cross compiled an executable to run on Debian Stretch that requires a specific version of cURL (greater than 7.56) to run, and needs specific capabilities during execution. So on the executable ...
yodama's user avatar
  • 111
0 votes
1 answer
3k views

setcap binary but with arguments?

I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark: root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground ...
Naftuli Kay's user avatar
  • 39.7k
1 vote
2 answers
584 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
md.jamal's user avatar
  • 291
0 votes
2 answers
725 views

Why sudo isn't acceptable?

I need to create a network bridge with 'brctl addbr br-lan' command in a sh script without using sudo. I have a script like; brctl addbr br-lan ifconfig lo up I have tried to set capabilities to my ...
SayMyName's user avatar
  • 125
13 votes
1 answer
6k views

Is setcap deprecated?

I'm starting a webserver as non-root using a systemd unit file. I am getting listen tcp :80: bind: permission denied even though I already ran setcap cap_net_bind_service=+ep on the executable. ...
AndreKR's user avatar
  • 1,100
23 votes
2 answers
34k views

Setcap not found in Debian 9

I'm using a installation scripts that needs setcap and it's not found. What package contains it? libcap2 is already installed.
Gabriel's user avatar
  • 543
0 votes
0 answers
1k views

setcap settings do not reflect in getcap

root@localhost:~# setcap cap_net_raw+p /bin/ping root@localhost:~# getcap /bin/ping root@localhost:~# ls -l $(which ping) -rwsr-xr-x. 1 root root 34752 Nov 8 2014 /bin/ping root@localhost:~# ping ...
kaza's user avatar
  • 101
40 votes
2 answers
102k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
T0m4t0s4uc3's user avatar
19 votes
2 answers
10k views

When using setcap, where is the permission stored?

Using setcap to give additional permissions to a binary should write the new permission somewhere, on storage or in memory, where is it stored ? Using lsof as is doesn't work because the process ...
Zulgrib's user avatar
  • 984
1 vote
2 answers
1k views

Where during booting are capabilities retrieved

I want a node application to have the ability to bind to low number ports (443 to be precise, since its an http2 server). I do this with sudo setcap cap_net_bind_service=+ep /path/to/node This is ...
akc42's user avatar
  • 351
1 vote
1 answer
3k views

Set hostname without root, and without CAP_SYS_ADMIN

I have an application that I want to be able to change the hostname in Linux. Currently doing so by running the hostname command. I don't want to set CAP_SYS_ADMIN either. I also don't want to edit ...
Antonius Bloch's user avatar
21 votes
2 answers
9k views

'setcap' overwrites last capability. How do I set multiple capabilities?

I want to give node.js the ability to listen on port 80, and shutdown the computer. Initially I tried these two commands in sequence: setcap cap_net_bind_service=+ep /usr/bin/nodejs setcap ...
Antonius Bloch's user avatar
4 votes
1 answer
1k views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
Matthew Cline's user avatar
9 votes
2 answers
8k views

Passing capabilities through exec

I'm trying to understand how Linux capabilities are passed to a process that has been exec()'d by another one. From what I've read, in order for a capability to be kept after exec, it must be in the ...
AdmiralNemo's user avatar
1 vote
2 answers
2k views

setcap for rhel5

A quick question: I am not able to find much info to run setcap on rhel5 . I searched few packages in my system # yum install libcap Loaded plugins: product-id, security, subscription-...
Akaks's user avatar
  • 449
3 votes
3 answers
355 views

possibility of running daemons with under privileged users during bootup

I have an authoritative DNS daemon in my test DNS setup which is responsible to provide host IP at best choice. This daemon/process can run by setting some capabilities using setcap and then a ...
Akaks's user avatar
  • 449
3 votes
1 answer
1k views

One non-root user run jetty by port 512 which less that port1024

Customer asks us to create a non-root user to run our web system which bind port 512, less than 1024. When web server(jetty) runs, this is the exception: 2013-10-16 14:49:51.406:WARN::failed Server@...
Evans's user avatar
  • 31
12 votes
2 answers
18k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap returns [...
ams's user avatar
  • 1,358
18 votes
1 answer
6k views

Can capabilities be used in scripts without setcap'ing the interpreter binary?

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf. Now I just need to set cap_net_bind_service+i on the interpreter of my favorite scripting language to be able to ...
ThiefMaster's user avatar
  • 2,347
20 votes
6 answers
33k views

How can I set up a remote port forward on port 80 to my localhost with the help of setcap?

I'd like to accept connections briefly for development when I'm NATed, and so I'm attempting to do this: $ ssh [email protected] -R 80:localhost:80 Which fails as I'm trying to bind a port that is ...
Kit Sunde's user avatar
  • 4,504