Understanding Linux Capabilities
1. Understanding Capability Types
| Capability | Description | Scope | Notes |
|---|---|---|---|
| CAP_CHOWN | Change ownership of files | File system | Allows changing the user ID (UID) and group ID (GID) of files |
| CAP_DAC_READ_SEARCH | Bypass file read permission checks | File system | Allows reading files and searching directories without read permission |
| CAP_DAC_OVERRIDE | Bypass file read, write, and execute permission checks | File system | Allows reading, writing, and executing files without permission checks |
| CAP_FOWNER | Bypass file ownership checks | File system | Allows ignoring the user ID (UID) check for file operations |
| CAP_FSETID | Set file user ID (SUID) and group ID (SGID) | File system | Allows setting the set-user-ID (SUID) and set-group-ID (SGID) bits on files |
| CAP_KILL | Bypass permission checks for sending signals to processes | Process control | Allows sending signals to any process, even if not owned by the user |
| CAP_SETGID | Change group ID (GID) | Process control | Allows changing the effective GID or saved GID of a process |
| CAP_SETUID | Change user ID (UID) | Process control | Allows changing the effective UID or saved UID of a process |
| CAP_SETPCAP | Modify capabilities set | Process control | Allows setting or modifying the capability set of a process |
| CAP_NET_BIND_SERVICE | Bind to privileged ports (e.g., below 1024) | Network | Allows binding to ports below 1024 without root privileges |
| CAP_NET_ADMIN | Perform network administration tasks | Network | Allows configuring network interfaces and modifying routing tables |
| CAP_NET_RAW | Use raw sockets | Network | Allows sending and receiving raw network packets (e.g., ICMP, TCP) |
| CAP_SYS_MODULE | Load and unload kernel modules | Kernel | Allows inserting or removing kernel modules from the running kernel |
| CAP_SYS_ADMIN | Perform administrative operations | System | Allows performing various system administration tasks (e.g., mounting filesystems) |
| CAP_SYS_CHROOT | Change root directory | System | Allows changing the root directory to another location |
| CAP_SYS_TIME | Change system clock | System | Allows setting the system time (e.g., using adjtimex) |
| CAP_SYS_PTRACE | Trace processes | System | Allows tracing and debugging other processes using ptrace |
| CAP_SYS_BOOT | Reboot the system | System | Allows rebooting or halting the system using reboot |
| CAP_SYS_NICE | Adjust process scheduling priority | System | Allows changing the scheduling policy and priority of processes |
| CAP_SYS_RESOURCE | Modify system resource limits | System | Allows modifying resource limits (e.g., ulimit) |
Note: Capabilities are a more granular alternative to full root privileges. They allow specific operations without granting all root permissions.
2. Viewing File Capabilities
| Capability | Description | Permission Level |
|---|---|---|
| CAP_CHOWN | Change ownership of files | File system |
| CAP_DAC_READ_SEARCH | Bypass file read permission checks | File system |
| CAP_DAC_WRITE_SEARCH | Bypass file write and search permission checks | File system |
| CAP_FOWNER | Bypass file ownership checks | File system |
| CAP_FSETID | Set the set-user-ID bit on files | File system |
| CAP_KILL | Bypass permission checks for sending signals | Process control |
| CAP_SETGID | Change group ID | Process control |
| CAP_SETUID | Change user ID | Process control |
| CAP_SETPCAP | Modify capabilities set | Process control |
| CAP_NET_BIND_SERVICE | Bind to privileged ports (e.g., port 80) | Network |
| CAP_NET_ADMIN | Perform network administration tasks | Network |
| CAP_NET_RAW | Use raw sockets | Network |
| CAP_SYS_MODULE | Load and unload kernel modules | System |
| CAP_SYS_RAWIO | Perform I/O operations without restrictions | System |
| CAP_SYS_CHROOT | Change root directory | System |
| CAP_SYS_TIME | Change system clock | System |
| CAP_SYS_PTRACE | Trace processes | System |
| CAP_SYS_ADMIN | Perform administrative operations | System |
Note: The
getcap command displays capabilities in the format capability=permission. For example, cap_net_raw+ep means the file has the CAP_NET_RAW capability with effective and permitted flags set.
Warning: Capabilities can be exploited if not properly managed. Always ensure that only necessary capabilities are assigned to files.
3. Setting File Capabilities
File capabilities allow specific privileges to be granted to executables without requiring root access. These are set using the setcap command.
| Capability | Description | Usage Example |
|---|---|---|
| cap_net_bind_service | Allows binding to privileged ports (< 1024) | setcap cap_net_bind_service=ep /usr/bin/myapp |
| cap_sys_admin | Allows administrative operations like mounting filesystems | setcap cap_sys_admin=ep /usr/bin/mount |
| cap_dac_read_search | Bypasses read permission checks for files and directories | setcap cap_dac_read_search=ep /usr/bin/ls |
Note: Capabilities are only effective if the binary is not owned by root or does not have the setuid bit set.
Warning: Misuse of capabilities can lead to security vulnerabilities. Always audit capability assignments.
Summary of Capabilities
- cap_net_bind_service - Binds to privileged ports
- cap_sys_admin - Mounts filesystems and other admin tasks
- cap_dac_read_search - Bypasses file read permissions
4. Viewing Process Capabilities
| Capability | Description | Permission Level | Usage Example |
|---|---|---|---|
| CAP_CHOWN | Change ownership of files | Effective | sudo setcap cap_chown+ep /usr/bin/myapp |
| CAP_DAC_READ_SEARCH | Bypass file read permission checks | Effective | capsh --caps=cap_dac_read_search+ep -- -c "cat /etc/secret" |
| CAP_DAC_OVERRIDE | Bypass file read, write, and execute permission checks | Effective | capsh --caps=cap_dac_override+ep -- -c "echo 'data' > /etc/protected" |
| CAP_FOWNER | Bypass file ownership checks | Effective | sudo setcap cap_fowner+ep /usr/bin/myapp |
| CAP_SETUID | Change user ID | Effective | capsh --caps=cap_setuid+ep -- -c "id" |
| CAP_SETGID | Change group ID | Effective | capsh --caps=cap_setgid+ep -- -c "id" |
| CAP_SETPCAP | Modify capabilities set | Effective | sudo setcap cap_setpcap+ep /usr/bin/myapp |
| CAP_NET_BIND_SERVICE | Bind to privileged ports (e.g., port 80) | Effective | capsh --caps=cap_net_bind_service+ep -- -c "nc -l 80" |
| CAP_SYS_ADMIN | Perform system administration tasks | Effective | capsh --caps=cap_sys_admin+ep -- -c "mount /dev/sdb1 /mnt" |
| CAP_SYS_PTRACE | Trace processes | Effective | capsh --caps=cap_sys_ptrace+ep -- -c "strace -p 1234" |
Note: Capabilities are a more granular alternative to running processes as root. They allow specific permissions without full root access.
5. Understanding Capability Sets
| Capability Set | Description | Permissions | Usage Notes |
|---|---|---|---|
| Effective | Active capabilities that are currently in effect for the process | Full set of permitted capabilities | Used to determine what actions the process can perform at runtime |
| Permitted | Capabilities that the process is allowed to assume | Full set of capabilities that can be activated | Used to control which capabilities can be enabled or disabled |
| Inheritable | Capabilities that can be inherited by child processes | Subset of permitted capabilities | Used to pass capabilities to child processes that are launched |
| Bounding | Set of capabilities that can be used to limit capability sets | Subset of all available capabilities | Used to restrict the capabilities that can be assumed by a process |
| Ambient | Capabilities that are effective in set-user-ID and set-group-ID programs | Subset of permitted capabilities | Used in environments where capability inheritance is required for privilege escalation |
Note: Capabilities are a more granular way to manage privileges than full root access, allowing fine-grained control over system operations.
6. Using capsh for Testing
Example: Testing capabilities with capsh
# Check current capabilities
capsh --print
# Test with specific capabilities
capsh --caps="cap_net_admin+eip" -- -c "echo 'Testing net_admin capability'"
# Drop all capabilities except specified
capsh --drop="cap_net_admin" -- -c "id"| Capability | Permission | Usage Example |
|---|---|---|
| cap_net_admin | Configure network interfaces | capsh --caps="cap_net_admin+eip" |
| cap_sys_admin | Perform system administration tasks | capsh --caps="cap_sys_admin+eip" |
| cap_chown | Change file ownership | capsh --caps="cap_chown+eip" |
Note: The
capsh utility is part of the libcap package and provides a safe way to test capabilities without affecting system security.Warning: Running processes with elevated capabilities can pose security risks. Always test in a controlled environment.
7. Dropping Capabilities
| Capability | Description | Action |
|---|---|---|
| CAP_CHOWN | Change ownership of files | capsh --drop=CAP_CHOWN -- |
| CAP_DAC_READ_SEARCH | Bypass file read permission checks | capsh --drop=CAP_DAC_READ_SEARCH -- |
| CAP_DAC_OVERRIDE | Bypass file read, write, and execute permission checks | capsh --drop=CAP_DAC_OVERRIDE -- |
| CAP_FOWNER | Bypass file ownership checks | capsh --drop=CAP_FOWNER -- |
| CAP_SETUID | Change user ID | capsh --drop=CAP_SETUID -- |
| CAP_SETGID | Change group ID | capsh --drop=CAP_SETGID -- |
Note: Dropping capabilities reduces the risk of privilege escalation attacks by limiting what a process can do even if it is compromised.
8. Understanding Capability Bounding Set
| Capability | Description | Default State | Notes |
|---|---|---|---|
| CAP_CHOWN | Change ownership of files | Allowed | Allows changing the user and group IDs of files |
| CAP_DAC_OVERRIDE | Bypass file read, write, and execute permission checks | Allowed | Allows reading and writing files regardless of permissions |
| CAP_DAC_READ_SEARCH | Bypass file read and search permission checks | Allowed | Allows reading files and searching directories without read permission |
| CAP_FOWNER | Bypass file ownership checks | Allowed | Allows changing the owner of a file to any user |
| CAP_FSETID | Set the set-user-ID bit on files | Allowed | Allows setting the setuid/setgid bits on files |
| CAP_KILL | Bypass permission checks for sending signals to processes | Allowed | Allows sending signals to any process, even if not owned by the user |
| CAP_SETGID | Change group ID | Allowed | Allows changing the effective GID of a process |
| CAP_SETUID | Change user ID | Allowed | Allows changing the effective UID of a process |
| CAP_SETPCAP | Modify capability sets | Allowed | Allows setting or modifying the capability set of a process |
| CAP_LINUX_IMMUTABLE | Set immutable and append-only attributes on files | Allowed | Allows setting the immutable or append-only attribute on files |
| CAP_NET_BIND_SERVICE | Bind to privileged ports (e.g., port 80) | Allowed | Allows binding to ports below 1024 without root privileges |
| CAP_NET_ADMIN | Perform network administration tasks | Allowed | Allows configuring network interfaces and routing tables |
| CAP_NET_RAW | Use raw sockets and packet sockets | Allowed | Allows sending and receiving raw network packets |
| CAP_IPC_LOCK | Lock memory pages | Allowed | Allows locking memory to prevent swapping |
| CAP_IPC_OWNER | Bypass IPC ownership checks | Allowed | Allows accessing shared memory segments and message queues without ownership |
| CAP_SYS_MODULE | Load and unload kernel modules | Allowed | Allows inserting or removing kernel modules |
| CAP_SYS_RAWIO | Perform I/O port operations | Allowed | Allows direct access to I/O ports (e.g., via /dev/port) |
| CAP_SYS_CHROOT | Change root directory | Allowed | Allows changing the root directory to another location |
| CAP_SYS_TIME | Change system clock | Allowed | Allows setting the system time (e.g., using settimeofday) |
| CAP_SYS_PTRACE | Trace processes | Allowed | Allows tracing or attaching to any process |
| CAP_SYS_BOOT | Reboot the system | Allowed | Allows rebooting or halting the system |
| CAP_SYS_NICE | Adjust process scheduling priority | Allowed | Allows setting real-time scheduling policies and priorities |
| CAP_SYS_RESOURCE | Override resource limits | Allowed | Allows overriding resource limits (e.g., ulimit) |
| CAP_SYS_TTY_CONFIG | Configure TTY devices | Allowed | Allows setting terminal settings and controlling TTYs |
| CAP_SYS_ADMIN | Perform administrative operations | Allowed | Allows various system administration tasks (e.g., mount, umount) |
| CAP_SYSLOG | Read system logs | Allowed | Allows reading kernel logs and messages |
| CAP_AUDIT_WRITE | Write audit logs | Allowed | Allows writing to the audit log |
| CAP_AUDIT_CONTROL | Control audit subsystem | Allowed | Allows enabling/disabling the audit subsystem |
| CAP_SETFCAP | Set file capabilities | Allowed | Allows setting file capabilities on files |
| CAP_MAC_OVERRIDE | Override MAC policies (e.g., SELinux) | Allowed | Allows overriding MAC policies (e.g., SELinux or AppArmor) |
| CAP_MAC_ADMIN | Modify MAC policies (e.g., SELinux) | Allowed | Allows modifying MAC policies (e.g., SELinux or AppArmor) |
| CAP_SYS_PACCT | Control process accounting | Allowed | Allows enabling or disabling process accounting |
| CAP_SYS_ADMIN | Perform administrative operations | Allowed | Allows various system administration tasks (e.g., mount, umount) |
| CAP_SYSLOG | Read system logs | Allowed | Allows reading kernel logs and messages |
| CAP_AUDIT_WRITE | Write audit logs | Allowed | Allows writing to the audit log |
| CAP_AUDIT_CONTROL | Control audit subsystem | Allowed | Allows enabling/disabling the audit subsystem |
| CAP_SETFCAP | Set file capabilities | Allowed | Allows setting file capabilities on files |
| CAP_MAC_OVERRIDE | Override MAC policies (e.g., SELinux) | Allowed | Allows overriding MAC policies (e.g., SELinux or AppArmor) |
| CAP_MAC_ADMIN | Modify MAC policies (e.g., SELinux) | Allowed | Allows modifying MAC policies (e.g., SELinux or AppArmor) |
| CAP_SYS_PACCT | Control process accounting | Allowed | Allows enabling or disabling process accounting |
Note: The capability bounding set is a list of capabilities that can be inherited by child processes. It limits which capabilities can be added to a process's effective capability set.
Warning: Modifying the capability bounding set can have security implications. Only grant capabilities that are strictly necessary for the application to function.
9. Comparing Capabilities vs SUID
| Feature | Capabilities | SUID |
|---|---|---|
| Scope of Privilege | Granular, specific privileges (e.g., cap_net_admin) |
Full root privileges for the owning user |
| Security Model | Principle of least privilege; only required capabilities are granted | Full system access for the user who owns the binary |
| Configuration | Set via setcap and checked with getcap |
Set via chmod u+s on the binary |
| Example Use Case | Allow a process to bind to privileged ports without full root access | Enable ping to send raw packets without root login |
| Risk Level | Lower risk due to limited capabilities | Higher risk as it grants full root access to the user |
| Default Behavior | Processes run with minimal capabilities by default | Processes run with full root privileges if set |
Note: Capabilities are preferred over SUID for better security, as they provide more granular control.
10. Managing Capabilities with systemd
| Property | Values | Description |
|---|---|---|
| User | root |
Systemd unit runs as root by default |
| CapabilityBoundingSet | @network-admin @sys-admin |
Defines the capabilities that can be used by the unit |
| AmbientCapabilities | @net_bind_service |
Capabilities that are inherited by child processes |
| SecureBits | keep-caps |
Controls how capabilities are handled in setuid/setgid programs |
Example: systemd service with capabilities
[Unit]
Description=Service with network capabilities
[Service]
Type=simple
User=root
CapabilityBoundingSet=@network-admin @sys-admin
AmbientCapabilities=@net_bind_service
ExecStart=/usr/bin/myapp
[Install]
WantedBy=multi-user.target
Note: Capabilities can be managed using
capsh or setcap for individual binaries, but systemd provides a more centralized and declarative approach.
Warning: Granting
@sys-admin capability can be dangerous as it allows modification of system settings and potentially compromise the host.
Summary of systemd Capabilities
- User field determines the effective user for the unit.
- CapabilityBoundingSet restricts which capabilities the unit can use.
- AmbientCapabilities allows child processes to inherit specific capabilities.
- SecureBits controls how capabilities are handled in setuid/setgid programs.