Linux capabilities

Understanding Capabilities

Traditionally, on Unix-like systems, a process either runs as the root user (UID 0), which has complete control, or as a regular, unprivileged user. This model is a security risk; if a program running as root has a vulnerability, an attacker could exploit it to gain full control of the system. Capabilities break down root’s privileges into distinct units, which can be granted to specific processes or files. This is known as the principle of least privilege, a core security concept. A process is given only the permissions it absolutely needs to perform its task, and no more.

Explanations of Capabilities

Here’s a breakdown of the capabilities shown in the image, categorized for clarity:

File System and Ownership

• cap_chown: Allows a process to change the user and group ownership of files. This is normally a root-only operation.
• cap_dac_override: Permits a process to bypass all Discretionary Access Control (DAC) file and directory permissions checks. This essentially lets a process read, write, or execute any file on the system, regardless of its owner or permissions.
• cap_dac_read_search: Similar to the above, but more limited. It allows a process to bypass DAC checks for reading files and searching directories.
• cap_fowner: Grants a process the ability to bypass DAC checks on operations that normally require the process's effective UID to match the file's UID. For instance, this allows changing permissions (chmod), ownership (chown), or timestamps on files you don't own.
• cap_fsetid: Allows a process to set the setuid and setgid bits on files. The setuid bit allows an executable to run with the permissions of its owner (often root), while the setgid bit does the same for the group. This is a very powerful capability.
• cap_linux_immutable: Grants the ability to set the FS_IMMUTABLE and FS_APPEND file attributes. Files with the FS_IMMUTABLE attribute cannot be modified, even by root. The FS_APPEND attribute allows data to only be appended to the end of the file.

Process Management

• cap_kill: Allows a process to send signals (like SIGKILL) to processes owned by other users. Ordinarily, a process can only signal processes with the same UID.
• cap_setgid: Allows a process to change its effective, real, and saved GIDs (Group IDs).
• cap_setuid: Allows a process to change its effective, real, and saved UIDs (User IDs).
• cap_setpcap: Grants the ability to add or remove capabilities from other processes, and to set the capabilities of a file. This is a very high-level and dangerous capability as it can be used to escalate privileges.
• cap_sys_ptrace: Allows a process to trace another process using ptrace. This is commonly used by debuggers and can be used to inspect and manipulate other processes' memory and state.
• cap_sys_nice: Allows a process to change the nice values of other processes, which affects their scheduling priority. This can be used to deprioritize other processes or boost the priority of a critical one.

Networking

• cap_net_bind_service: Allows a process to bind to privileged ports (ports below 1024). This is commonly used by services like web servers that need to listen on port 80 or 443.
• cap_net_broadcast: Grants the ability to send broadcasts on a network.
• cap_net_admin: Allows a process to perform various network-related administrative tasks, such as configuring network interfaces, setting up firewalls, and managing routing tables.
• cap_net_raw: Permits a process to use raw sockets, which allows a program to read and write low-level network packets. This is essential for tools like ping or tcpdump.

Get Cyber Gee’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

System Administration and Security

• cap_ipc_lock: Allows a process to lock shared memory segments into RAM, preventing them from being swapped out to disk. This is important for high-performance applications and real-time systems.
• cap_ipc_owner: Bypasses IPC (Inter-Process Communication) ownership checks, allowing a process to control IPC objects (like message queues or semaphores) that it doesn't own.
• cap_sys_module: Allows a process to load and unload kernel modules. This is a very powerful capability that could be used to compromise the entire system.
• cap_sys_rawio: Grants a process the ability to perform low-level I/O operations, such as accessing block devices and port I/O.
• cap_sys_chroot: Allows a process to use the chroot() system call, which changes the root directory of a process and its children. This is a common security mechanism to isolate applications.
• cap_sys_boot: Allows a process to reboot the system.
• cap_sys_nice: Allows a process to change the niceness of other processes.
• cap_sys_resource: Grants the ability to override resource limits (like maximum number of open files, memory usage, etc.) and to increase process priority.
• cap_sys_time: Allows a process to change the system time.
• cap_sys_tty_config: Permits a process to perform privileged tty (terminal) operations, such as setting up the console.
• cap_mknod: Grants the ability to create special files (like device files) using the mknod() system call.
• cap_audit_read: Allows a process to read the audit log.
• cap_audit_write: Allows a process to write records to the audit log.
• cap_audit_control: Grants a process the ability to enable and disable auditing, and to set audit filters.
• cap_setfcap: Allows a process to set the capabilities on a file.
• cap_mac_override: Bypasses Mandatory Access Control (MAC) policies, such as SELinux or AppArmor. This is an extremely powerful capability.
• cap_mac_admin: Grants the ability to configure MAC policies.
• cap_syslog: Allows a process to perform privileged syslog operations.
• cap_wake_alarm: Allows a process to set a system wake-up alarm.
• cap_block_suspend: Prevents the system from entering suspend or hibernation states.

How it Works in Practice

Capabilities can be assigned to either an executable file or to a running process.

• File capabilities: When you set capabilities on an executable file, any user who runs that file will temporarily gain those capabilities while the program is running. For example, the ping command needs to use raw sockets, so it's often given the cap_net_raw capability on the executable file itself, allowing it to run as a non-root user while still having the necessary network privileges. * Process capabilities: A running process can also be granted capabilities directly by its parent process or by the system. This is a more dynamic approach used by process managers and container runtimes.

Capabilities are an essential part of modern Linux security models, widely used in containerization technologies like Docker and Kubernetes to run services with minimal privileges, significantly reducing the attack surface. They’re a fundamental concept for any serious programmer working on system-level applications or security-conscious environments.