Lesson 3.50: Capabilities: root's powers in pieces
Linux splits root's powers into about forty capabilities: binding ports below 1024, changing user IDs, raw network access, loading kernel modules and so on. A program can be given one capability instead of running as root. That's useful, and dangerous when the wrong one is given to the wrong program: cap_setuid on an interpreter lets any user become root. In the lab you list every file capability on web02, find a risky one left behind by a quick fix, remove it, and give the shop API just the right to bind port 443 through systemd instead.
15 min
You will learn to
- Explain Linux capabilities
- Find file capabilities with getcap -r
- Recognise dangerous capabilities
- Remove a capability with setcap -r
- Grant a capability to a service through systemd
Key terms
- Capability
- One of root's powers granted on its own.
- File capability
- Capabilities stored on an executable and granted when it runs.
- e / p / i
- Effective, permitted, inheritable: whether the capability is active, allowed, passed on.
- Ambient capabilities
- Capabilities a non-root process keeps across execve; systemd sets them per service.
- GTFOBins
- A public list of Unix programs that can be abused when given extra rights (sudo, SUID, capabilities).
← Working with files and directories · All lessons · Writing an AppArmor profile from its logs →