2409 lines
64 KiB
HTML
2409 lines
64 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of CAPABILITIES</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>CAPABILITIES</H1>
|
|
Section: Linux Programmer's Manual (7)<BR>Updated: 2019-08-02<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
capabilities - overview of Linux capabilities
|
|
<A NAME="lbAC"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
For the purpose of performing permission checks,
|
|
traditional UNIX implementations distinguish two categories of processes:
|
|
<I>privileged</I>
|
|
|
|
processes (whose effective user ID is 0, referred to as superuser or root),
|
|
and
|
|
<I>unprivileged</I>
|
|
|
|
processes (whose effective UID is nonzero).
|
|
Privileged processes bypass all kernel permission checks,
|
|
while unprivileged processes are subject to full permission
|
|
checking based on the process's credentials
|
|
(usually: effective UID, effective GID, and supplementary group list).
|
|
<P>
|
|
|
|
Starting with kernel 2.2, Linux divides the privileges traditionally
|
|
associated with superuser into distinct units, known as
|
|
<I>capabilities</I>,
|
|
|
|
which can be independently enabled and disabled.
|
|
Capabilities are a per-thread attribute.
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H3>Capabilities list</H3>
|
|
|
|
The following list shows the capabilities implemented on Linux,
|
|
and the operations or behaviors that each capability permits:
|
|
<DL COMPACT>
|
|
<DT id="1"><B>CAP_AUDIT_CONTROL</B> (since Linux 2.6.11)
|
|
|
|
<DD>
|
|
Enable and disable kernel auditing; change auditing filter rules;
|
|
retrieve auditing status and filtering rules.
|
|
<DT id="2"><B>CAP_AUDIT_READ</B> (since Linux 3.16)
|
|
|
|
<DD>
|
|
|
|
|
|
Allow reading the audit log via a multicast netlink socket.
|
|
<DT id="3"><B>CAP_AUDIT_WRITE</B> (since Linux 2.6.11)
|
|
|
|
<DD>
|
|
Write records to kernel auditing log.
|
|
|
|
<DT id="4"><B>CAP_BLOCK_SUSPEND</B> (since Linux 3.5)
|
|
|
|
<DD>
|
|
Employ features that can block system suspend
|
|
(<B><A HREF="/cgi-bin/man/man2html?7+epoll">epoll</A></B>(7)
|
|
|
|
<B>EPOLLWAKEUP</B>,
|
|
|
|
<I>/proc/sys/wake_lock</I>).
|
|
|
|
<DT id="5"><B>CAP_CHOWN</B>
|
|
|
|
<DD>
|
|
Make arbitrary changes to file UIDs and GIDs (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+chown">chown</A></B>(2)).
|
|
|
|
<DT id="6"><B>CAP_DAC_OVERRIDE</B>
|
|
|
|
<DD>
|
|
Bypass file read, write, and execute permission checks.
|
|
(DAC is an abbreviation of "discretionary access control".)
|
|
<DT id="7"><B>CAP_DAC_READ_SEARCH</B>
|
|
|
|
<DD>
|
|
|
|
<DL COMPACT><DT id="8"><DD>
|
|
<DL COMPACT>
|
|
<DT id="9">*<DD>
|
|
Bypass file read permission checks and
|
|
directory read and execute permission checks;
|
|
<DT id="10">*<DD>
|
|
invoke
|
|
<B><A HREF="/cgi-bin/man/man2html?2+open_by_handle_at">open_by_handle_at</A></B>(2);
|
|
|
|
<DT id="11">*<DD>
|
|
use the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+linkat">linkat</A></B>(2)
|
|
|
|
<B>AT_EMPTY_PATH</B>
|
|
|
|
flag to create a link to a file referred to by a file descriptor.
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="12"><B>CAP_FOWNER</B>
|
|
|
|
<DD>
|
|
|
|
<DL COMPACT><DT id="13"><DD>
|
|
<DL COMPACT>
|
|
<DT id="14">*<DD>
|
|
Bypass permission checks on operations that normally
|
|
require the filesystem UID of the process to match the UID of
|
|
the file (e.g.,
|
|
<B><A HREF="/cgi-bin/man/man2html?2+chmod">chmod</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+utime">utime</A></B>(2)),
|
|
|
|
excluding those operations covered by
|
|
<B>CAP_DAC_OVERRIDE</B>
|
|
|
|
and
|
|
<B>CAP_DAC_READ_SEARCH</B>;
|
|
|
|
<DT id="15">*<DD>
|
|
set inode flags (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl_iflags">ioctl_iflags</A></B>(2))
|
|
|
|
on arbitrary files;
|
|
<DT id="16">*<DD>
|
|
set Access Control Lists (ACLs) on arbitrary files;
|
|
<DT id="17">*<DD>
|
|
ignore directory sticky bit on file deletion;
|
|
<DT id="18">*<DD>
|
|
modify
|
|
<I>user</I>
|
|
|
|
extended attributes on sticky directory owned by any user;
|
|
<DT id="19">*<DD>
|
|
specify
|
|
<B>O_NOATIME</B>
|
|
|
|
for arbitrary files in
|
|
<B><A HREF="/cgi-bin/man/man2html?2+open">open</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fcntl">fcntl</A></B>(2).
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="20"><B>CAP_FSETID</B>
|
|
|
|
<DD>
|
|
|
|
<DL COMPACT><DT id="21"><DD>
|
|
<DL COMPACT>
|
|
<DT id="22">*<DD>
|
|
Don't clear set-user-ID and set-group-ID mode
|
|
bits when a file is modified;
|
|
<DT id="23">*<DD>
|
|
set the set-group-ID bit for a file whose GID does not match
|
|
the filesystem or any of the supplementary GIDs of the calling process.
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="24"><B>CAP_IPC_LOCK</B>
|
|
|
|
<DD>
|
|
|
|
|
|
Lock memory
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+mlock">mlock</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mlockall">mlockall</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mmap">mmap</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+shmctl">shmctl</A></B>(2)).
|
|
|
|
<DT id="25"><B>CAP_IPC_OWNER</B>
|
|
|
|
<DD>
|
|
Bypass permission checks for operations on System V IPC objects.
|
|
<DT id="26"><B>CAP_KILL</B>
|
|
|
|
<DD>
|
|
Bypass permission checks for sending signals (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+kill">kill</A></B>(2)).
|
|
|
|
This includes use of the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl">ioctl</A></B>(2)
|
|
|
|
<B>KDSIGACCEPT</B>
|
|
|
|
operation.
|
|
|
|
|
|
|
|
|
|
|
|
<DT id="27"><B>CAP_LEASE</B> (since Linux 2.4)
|
|
|
|
<DD>
|
|
Establish leases on arbitrary files (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fcntl">fcntl</A></B>(2)).
|
|
|
|
<DT id="28"><B>CAP_LINUX_IMMUTABLE</B>
|
|
|
|
<DD>
|
|
Set the
|
|
<B>FS_APPEND_FL</B>
|
|
|
|
and
|
|
<B>FS_IMMUTABLE_FL</B>
|
|
|
|
inode flags (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl_iflags">ioctl_iflags</A></B>(2)).
|
|
|
|
<DT id="29"><B>CAP_MAC_ADMIN</B> (since Linux 2.6.25)
|
|
|
|
<DD>
|
|
Allow MAC configuration or state changes.
|
|
Implemented for the Smack Linux Security Module (LSM).
|
|
<DT id="30"><B>CAP_MAC_OVERRIDE</B> (since Linux 2.6.25)
|
|
|
|
<DD>
|
|
Override Mandatory Access Control (MAC).
|
|
Implemented for the Smack LSM.
|
|
<DT id="31"><B>CAP_MKNOD</B> (since Linux 2.4)
|
|
|
|
<DD>
|
|
Create special files using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mknod">mknod</A></B>(2).
|
|
|
|
<DT id="32"><B>CAP_NET_ADMIN</B>
|
|
|
|
<DD>
|
|
Perform various network-related operations:
|
|
|
|
<DL COMPACT><DT id="33"><DD>
|
|
<DL COMPACT>
|
|
<DT id="34">*<DD>
|
|
interface configuration;
|
|
<DT id="35">*<DD>
|
|
administration of IP firewall, masquerading, and accounting;
|
|
<DT id="36">*<DD>
|
|
modify routing tables;
|
|
<DT id="37">*<DD>
|
|
bind to any address for transparent proxying;
|
|
<DT id="38">*<DD>
|
|
set type-of-service (TOS)
|
|
<DT id="39">*<DD>
|
|
clear driver statistics;
|
|
<DT id="40">*<DD>
|
|
set promiscuous mode;
|
|
<DT id="41">*<DD>
|
|
enabling multicasting;
|
|
<DT id="42">*<DD>
|
|
use
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setsockopt">setsockopt</A></B>(2)
|
|
|
|
to set the following socket options:
|
|
<B>SO_DEBUG</B>,
|
|
|
|
<B>SO_MARK</B>,
|
|
|
|
<B>SO_PRIORITY</B>
|
|
|
|
(for a priority outside the range 0 to 6),
|
|
<B>SO_RCVBUFFORCE</B>,
|
|
|
|
and
|
|
<B>SO_SNDBUFFORCE</B>.
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="43"><B>CAP_NET_BIND_SERVICE</B>
|
|
|
|
<DD>
|
|
Bind a socket to Internet domain privileged ports
|
|
(port numbers less than 1024).
|
|
<DT id="44"><B>CAP_NET_BROADCAST</B>
|
|
|
|
<DD>
|
|
(Unused) Make socket broadcasts, and listen to multicasts.
|
|
|
|
|
|
<DT id="45"><B>CAP_NET_RAW</B>
|
|
|
|
<DD>
|
|
|
|
<DL COMPACT><DT id="46"><DD>
|
|
<DL COMPACT>
|
|
<DT id="47">*<DD>
|
|
Use RAW and PACKET sockets;
|
|
<DT id="48">*<DD>
|
|
bind to any address for transparent proxying.
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
|
|
<DT id="49"><B>CAP_SETGID</B>
|
|
|
|
<DD>
|
|
<DL COMPACT><DT id="50"><DD>
|
|
|
|
<DL COMPACT>
|
|
<DT id="51">*<DD>
|
|
Make arbitrary manipulations of process GIDs and supplementary GID list;
|
|
<DT id="52">*<DD>
|
|
forge GID when passing socket credentials via UNIX domain sockets;
|
|
<DT id="53">*<DD>
|
|
write a group ID mapping in a user namespace (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+user_namespaces">user_namespaces</A></B>(7)).
|
|
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="54"><B>CAP_SETFCAP</B> (since Linux 2.6.24)
|
|
|
|
<DD>
|
|
Set arbitrary capabilities on a file.
|
|
<DT id="55"><B>CAP_SETPCAP</B>
|
|
|
|
<DD>
|
|
If file capabilities are supported (i.e., since Linux 2.6.24):
|
|
add any capability from the calling thread's bounding set
|
|
to its inheritable set;
|
|
drop capabilities from the bounding set (via
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2)
|
|
|
|
<B>PR_CAPBSET_DROP</B>);
|
|
|
|
make changes to the
|
|
<I>securebits</I>
|
|
|
|
flags.
|
|
<DT id="56"><DD>
|
|
If file capabilities are not supported (i.e., kernels before Linux 2.6.24):
|
|
grant or remove any capability in the
|
|
caller's permitted capability set to or from any other process.
|
|
(This property of
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
is not available when the kernel is configured to support
|
|
file capabilities, since
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
has entirely different semantics for such kernels.)
|
|
<DT id="57"><B>CAP_SETUID</B>
|
|
|
|
<DD>
|
|
<DL COMPACT><DT id="58"><DD>
|
|
|
|
<DL COMPACT>
|
|
<DT id="59">*<DD>
|
|
Make arbitrary manipulations of process UIDs
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+setuid">setuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setreuid">setreuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setresuid">setresuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setfsuid">setfsuid</A></B>(2));
|
|
|
|
<DT id="60">*<DD>
|
|
forge UID when passing socket credentials via UNIX domain sockets;
|
|
<DT id="61">*<DD>
|
|
write a user ID mapping in a user namespace (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+user_namespaces">user_namespaces</A></B>(7)).
|
|
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="62"><B>CAP_SYS_ADMIN</B>
|
|
|
|
<DD>
|
|
<I>Note</I>:
|
|
|
|
this capability is overloaded; see
|
|
<I>Notes to kernel developers</I>,
|
|
|
|
below.
|
|
<DT id="63"><DD>
|
|
|
|
<DL COMPACT><DT id="64"><DD>
|
|
<DL COMPACT>
|
|
<DT id="65">*<DD>
|
|
Perform a range of system administration operations including:
|
|
<B><A HREF="/cgi-bin/man/man2html?2+quotactl">quotactl</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mount">mount</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+umount">umount</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+pivot_root">pivot_root</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+swapon">swapon</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+swapoff">swapoff</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+sethostname">sethostname</A></B>(2),
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setdomainname">setdomainname</A></B>(2);
|
|
|
|
<DT id="66">*<DD>
|
|
perform privileged
|
|
<B><A HREF="/cgi-bin/man/man2html?2+syslog">syslog</A></B>(2)
|
|
|
|
operations (since Linux 2.6.37,
|
|
<B>CAP_SYSLOG</B>
|
|
|
|
should be used to permit such operations);
|
|
<DT id="67">*<DD>
|
|
perform
|
|
<B>VM86_REQUEST_IRQ</B>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+vm86">vm86</A></B>(2)
|
|
|
|
command;
|
|
<DT id="68">*<DD>
|
|
perform
|
|
<B>IPC_SET</B>
|
|
|
|
and
|
|
<B>IPC_RMID</B>
|
|
|
|
operations on arbitrary System V IPC objects;
|
|
<DT id="69">*<DD>
|
|
override
|
|
<B>RLIMIT_NPROC</B>
|
|
|
|
resource limit;
|
|
<DT id="70">*<DD>
|
|
perform operations on
|
|
<I>trusted</I>
|
|
|
|
and
|
|
<I>security</I>
|
|
|
|
Extended Attributes (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+xattr">xattr</A></B>(7));
|
|
|
|
<DT id="71">*<DD>
|
|
use
|
|
<B><A HREF="/cgi-bin/man/man2html?2+lookup_dcookie">lookup_dcookie</A></B>(2);
|
|
|
|
<DT id="72">*<DD>
|
|
use
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioprio_set">ioprio_set</A></B>(2)
|
|
|
|
to assign
|
|
<B>IOPRIO_CLASS_RT</B>
|
|
|
|
and (before Linux 2.6.25)
|
|
<B>IOPRIO_CLASS_IDLE</B>
|
|
|
|
I/O scheduling classes;
|
|
<DT id="73">*<DD>
|
|
forge PID when passing socket credentials via UNIX domain sockets;
|
|
<DT id="74">*<DD>
|
|
exceed
|
|
<I>/proc/sys/fs/file-max</I>,
|
|
|
|
the system-wide limit on the number of open files,
|
|
in system calls that open files (e.g.,
|
|
<B><A HREF="/cgi-bin/man/man2html?2+accept">accept</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+open">open</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+pipe">pipe</A></B>(2));
|
|
|
|
<DT id="75">*<DD>
|
|
employ
|
|
<B>CLONE_*</B>
|
|
|
|
flags that create new namespaces with
|
|
<B><A HREF="/cgi-bin/man/man2html?2+clone">clone</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+unshare">unshare</A></B>(2)
|
|
|
|
(but, since Linux 3.8,
|
|
creating user namespaces does not require any capability);
|
|
<DT id="76">*<DD>
|
|
call
|
|
<B><A HREF="/cgi-bin/man/man2html?2+perf_event_open">perf_event_open</A></B>(2);
|
|
|
|
<DT id="77">*<DD>
|
|
access privileged
|
|
<I>perf</I>
|
|
|
|
event information;
|
|
<DT id="78">*<DD>
|
|
call
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setns">setns</A></B>(2)
|
|
|
|
(requires
|
|
<B>CAP_SYS_ADMIN</B>
|
|
|
|
in the
|
|
<I>target</I>
|
|
|
|
namespace);
|
|
<DT id="79">*<DD>
|
|
call
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fanotify_init">fanotify_init</A></B>(2);
|
|
|
|
<DT id="80">*<DD>
|
|
call
|
|
<B><A HREF="/cgi-bin/man/man2html?2+bpf">bpf</A></B>(2);
|
|
|
|
<DT id="81">*<DD>
|
|
perform privileged
|
|
<B>KEYCTL_CHOWN</B>
|
|
|
|
and
|
|
<B>KEYCTL_SETPERM</B>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+keyctl">keyctl</A></B>(2)
|
|
|
|
operations;
|
|
<DT id="82">*<DD>
|
|
perform
|
|
<B><A HREF="/cgi-bin/man/man2html?2+madvise">madvise</A></B>(2)
|
|
|
|
<B>MADV_HWPOISON</B>
|
|
|
|
operation;
|
|
<DT id="83">*<DD>
|
|
employ the
|
|
<B>TIOCSTI</B>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl">ioctl</A></B>(2)
|
|
|
|
to insert characters into the input queue of a terminal other than
|
|
the caller's controlling terminal;
|
|
<DT id="84">*<DD>
|
|
employ the obsolete
|
|
<B><A HREF="/cgi-bin/man/man2html?2+nfsservctl">nfsservctl</A></B>(2)
|
|
|
|
system call;
|
|
<DT id="85">*<DD>
|
|
employ the obsolete
|
|
<B><A HREF="/cgi-bin/man/man2html?2+bdflush">bdflush</A></B>(2)
|
|
|
|
system call;
|
|
<DT id="86">*<DD>
|
|
perform various privileged block-device
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl">ioctl</A></B>(2)
|
|
|
|
operations;
|
|
<DT id="87">*<DD>
|
|
perform various privileged filesystem
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl">ioctl</A></B>(2)
|
|
|
|
operations;
|
|
<DT id="88">*<DD>
|
|
perform privileged
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl">ioctl</A></B>(2)
|
|
|
|
operations on the
|
|
<I>/dev/random</I>
|
|
|
|
device (see
|
|
<B><A HREF="/cgi-bin/man/man2html?4+random">random</A></B>(4));
|
|
|
|
<DT id="89">*<DD>
|
|
install a
|
|
<B><A HREF="/cgi-bin/man/man2html?2+seccomp">seccomp</A></B>(2)
|
|
|
|
filter without first having to set the
|
|
<I>no_new_privs</I>
|
|
|
|
thread attribute;
|
|
<DT id="90">*<DD>
|
|
modify allow/deny rules for device control groups;
|
|
<DT id="91">*<DD>
|
|
employ the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ptrace">ptrace</A></B>(2)
|
|
|
|
<B>PTRACE_SECCOMP_GET_FILTER</B>
|
|
|
|
operation to dump tracee's seccomp filters;
|
|
<DT id="92">*<DD>
|
|
employ the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ptrace">ptrace</A></B>(2)
|
|
|
|
<B>PTRACE_SETOPTIONS</B>
|
|
|
|
operation to suspend the tracee's seccomp protections (i.e., the
|
|
<B>PTRACE_O_SUSPEND_SECCOMP</B>
|
|
|
|
flag);
|
|
<DT id="93">*<DD>
|
|
perform administrative operations on many device drivers.
|
|
<DT id="94">*<DD>
|
|
Modify autogroup nice values by writing to
|
|
<I>/proc/[pid]/autogroup</I>
|
|
|
|
(see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+sched">sched</A></B>(7)).
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="95"><B>CAP_SYS_BOOT</B>
|
|
|
|
<DD>
|
|
Use
|
|
<B><A HREF="/cgi-bin/man/man2html?2+reboot">reboot</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+kexec_load">kexec_load</A></B>(2).
|
|
|
|
<DT id="96"><B>CAP_SYS_CHROOT</B>
|
|
|
|
<DD>
|
|
<DL COMPACT><DT id="97"><DD>
|
|
|
|
<DL COMPACT>
|
|
<DT id="98">*<DD>
|
|
Use
|
|
<B><A HREF="/cgi-bin/man/man2html?2+chroot">chroot</A></B>(2);
|
|
|
|
<DT id="99">*<DD>
|
|
change mount namespaces using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setns">setns</A></B>(2).
|
|
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="100"><B>CAP_SYS_MODULE</B>
|
|
|
|
<DD>
|
|
<DL COMPACT><DT id="101"><DD>
|
|
|
|
<DL COMPACT>
|
|
<DT id="102">*<DD>
|
|
Load and unload kernel modules
|
|
(see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+init_module">init_module</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+delete_module">delete_module</A></B>(2));
|
|
|
|
<DT id="103">*<DD>
|
|
in kernels before 2.6.25:
|
|
drop capabilities from the system-wide capability bounding set.
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="104"><B>CAP_SYS_NICE</B>
|
|
|
|
<DD>
|
|
|
|
<DL COMPACT><DT id="105"><DD>
|
|
<DL COMPACT>
|
|
<DT id="106">*<DD>
|
|
Raise process nice value
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+nice">nice</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setpriority">setpriority</A></B>(2))
|
|
|
|
and change the nice value for arbitrary processes;
|
|
<DT id="107">*<DD>
|
|
set real-time scheduling policies for calling process,
|
|
and set scheduling policies and priorities for arbitrary processes
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+sched_setscheduler">sched_setscheduler</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+sched_setparam">sched_setparam</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+sched_setattr">sched_setattr</A></B>(2));
|
|
|
|
<DT id="108">*<DD>
|
|
set CPU affinity for arbitrary processes
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+sched_setaffinity">sched_setaffinity</A></B>(2));
|
|
|
|
<DT id="109">*<DD>
|
|
set I/O scheduling class and priority for arbitrary processes
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+ioprio_set">ioprio_set</A></B>(2));
|
|
|
|
<DT id="110">*<DD>
|
|
apply
|
|
<B><A HREF="/cgi-bin/man/man2html?2+migrate_pages">migrate_pages</A></B>(2)
|
|
|
|
to arbitrary processes and allow processes
|
|
to be migrated to arbitrary nodes;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DT id="111">*<DD>
|
|
apply
|
|
<B><A HREF="/cgi-bin/man/man2html?2+move_pages">move_pages</A></B>(2)
|
|
|
|
to arbitrary processes;
|
|
<DT id="112">*<DD>
|
|
use the
|
|
<B>MPOL_MF_MOVE_ALL</B>
|
|
|
|
flag with
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mbind">mbind</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+move_pages">move_pages</A></B>(2).
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="113"><B>CAP_SYS_PACCT</B>
|
|
|
|
<DD>
|
|
Use
|
|
<B><A HREF="/cgi-bin/man/man2html?2+acct">acct</A></B>(2).
|
|
|
|
<DT id="114"><B>CAP_SYS_PTRACE</B>
|
|
|
|
<DD>
|
|
|
|
<DL COMPACT><DT id="115"><DD>
|
|
<DL COMPACT>
|
|
<DT id="116">*<DD>
|
|
Trace arbitrary processes using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ptrace">ptrace</A></B>(2);
|
|
|
|
<DT id="117">*<DD>
|
|
apply
|
|
<B><A HREF="/cgi-bin/man/man2html?2+get_robust_list">get_robust_list</A></B>(2)
|
|
|
|
to arbitrary processes;
|
|
<DT id="118">*<DD>
|
|
transfer data to or from the memory of arbitrary processes using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+process_vm_readv">process_vm_readv</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+process_vm_writev">process_vm_writev</A></B>(2);
|
|
|
|
<DT id="119">*<DD>
|
|
inspect processes using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+kcmp">kcmp</A></B>(2).
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="120"><B>CAP_SYS_RAWIO</B>
|
|
|
|
<DD>
|
|
|
|
<DL COMPACT><DT id="121"><DD>
|
|
<DL COMPACT>
|
|
<DT id="122">*<DD>
|
|
Perform I/O port operations
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+iopl">iopl</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioperm">ioperm</A></B>(2));
|
|
|
|
<DT id="123">*<DD>
|
|
access
|
|
<I>/proc/kcore</I>;
|
|
|
|
<DT id="124">*<DD>
|
|
employ the
|
|
<B>FIBMAP</B>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl">ioctl</A></B>(2)
|
|
|
|
operation;
|
|
<DT id="125">*<DD>
|
|
open devices for accessing x86 model-specific registers (MSRs, see
|
|
<B><A HREF="/cgi-bin/man/man2html?4+msr">msr</A></B>(4));
|
|
|
|
<DT id="126">*<DD>
|
|
update
|
|
<I>/proc/sys/vm/mmap_min_addr</I>;
|
|
|
|
<DT id="127">*<DD>
|
|
create memory mappings at addresses below the value specified by
|
|
<I>/proc/sys/vm/mmap_min_addr</I>;
|
|
|
|
<DT id="128">*<DD>
|
|
map files in
|
|
<I>/proc/bus/pci</I>;
|
|
|
|
<DT id="129">*<DD>
|
|
open
|
|
<I>/dev/mem</I>
|
|
|
|
and
|
|
<I>/dev/kmem</I>;
|
|
|
|
<DT id="130">*<DD>
|
|
perform various SCSI device commands;
|
|
<DT id="131">*<DD>
|
|
perform certain operations on
|
|
<B><A HREF="/cgi-bin/man/man2html?4+hpsa">hpsa</A></B>(4)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?4+cciss">cciss</A></B>(4)
|
|
|
|
devices;
|
|
<DT id="132">*<DD>
|
|
perform a range of device-specific operations on other devices.
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="133"><B>CAP_SYS_RESOURCE</B>
|
|
|
|
<DD>
|
|
|
|
<DL COMPACT><DT id="134"><DD>
|
|
<DL COMPACT>
|
|
<DT id="135">*<DD>
|
|
Use reserved space on ext2 filesystems;
|
|
<DT id="136">*<DD>
|
|
make
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl">ioctl</A></B>(2)
|
|
|
|
calls controlling ext3 journaling;
|
|
<DT id="137">*<DD>
|
|
override disk quota limits;
|
|
<DT id="138">*<DD>
|
|
increase resource limits (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setrlimit">setrlimit</A></B>(2));
|
|
|
|
<DT id="139">*<DD>
|
|
override
|
|
<B>RLIMIT_NPROC</B>
|
|
|
|
resource limit;
|
|
<DT id="140">*<DD>
|
|
override maximum number of consoles on console allocation;
|
|
<DT id="141">*<DD>
|
|
override maximum number of keymaps;
|
|
<DT id="142">*<DD>
|
|
allow more than 64hz interrupts from the real-time clock;
|
|
<DT id="143">*<DD>
|
|
raise
|
|
<I>msg_qbytes</I>
|
|
|
|
limit for a System V message queue above the limit in
|
|
<I>/proc/sys/kernel/msgmnb</I>
|
|
|
|
(see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+msgop">msgop</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+msgctl">msgctl</A></B>(2));
|
|
|
|
<DT id="144">*<DD>
|
|
allow the
|
|
<B>RLIMIT_NOFILE</B>
|
|
|
|
resource limit on the number of "in-flight" file descriptors
|
|
to be bypassed when passing file descriptors to another process
|
|
via a UNIX domain socket (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+unix">unix</A></B>(7));
|
|
|
|
<DT id="145">*<DD>
|
|
override the
|
|
<I>/proc/sys/fs/pipe-size-max</I>
|
|
|
|
limit when setting the capacity of a pipe using the
|
|
<B>F_SETPIPE_SZ</B>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fcntl">fcntl</A></B>(2)
|
|
|
|
command.
|
|
<DT id="146">*<DD>
|
|
use
|
|
<B>F_SETPIPE_SZ</B>
|
|
|
|
to increase the capacity of a pipe above the limit specified by
|
|
<I>/proc/sys/fs/pipe-max-size</I>;
|
|
|
|
<DT id="147">*<DD>
|
|
override
|
|
<I>/proc/sys/fs/mqueue/queues_max</I>
|
|
|
|
limit when creating POSIX message queues (see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+mq_overview">mq_overview</A></B>(7));
|
|
|
|
<DT id="148">*<DD>
|
|
employ the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2)
|
|
|
|
<B>PR_SET_MM</B>
|
|
|
|
operation;
|
|
<DT id="149">*<DD>
|
|
set
|
|
<I>/proc/[pid]/oom_score_adj</I>
|
|
|
|
to a value lower than the value last set by a process with
|
|
<B>CAP_SYS_RESOURCE</B>.
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
|
|
<DT id="150"><B>CAP_SYS_TIME</B>
|
|
|
|
<DD>
|
|
Set system clock
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+settimeofday">settimeofday</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+stime">stime</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+adjtimex">adjtimex</A></B>(2));
|
|
|
|
set real-time (hardware) clock.
|
|
<DT id="151"><B>CAP_SYS_TTY_CONFIG</B>
|
|
|
|
<DD>
|
|
Use
|
|
<B><A HREF="/cgi-bin/man/man2html?2+vhangup">vhangup</A></B>(2);
|
|
|
|
employ various privileged
|
|
<B><A HREF="/cgi-bin/man/man2html?2+ioctl">ioctl</A></B>(2)
|
|
|
|
operations on virtual terminals.
|
|
<DT id="152"><B>CAP_SYSLOG</B> (since Linux 2.6.37)
|
|
|
|
<DD>
|
|
<DL COMPACT><DT id="153"><DD>
|
|
|
|
<DL COMPACT>
|
|
<DT id="154">*<DD>
|
|
Perform privileged
|
|
<B><A HREF="/cgi-bin/man/man2html?2+syslog">syslog</A></B>(2)
|
|
|
|
operations.
|
|
See
|
|
<B><A HREF="/cgi-bin/man/man2html?2+syslog">syslog</A></B>(2)
|
|
|
|
for information on which operations require privilege.
|
|
<DT id="155">*<DD>
|
|
View kernel addresses exposed via
|
|
<I>/proc</I>
|
|
|
|
and other interfaces when
|
|
<I>/proc/sys/kernel/kptr_restrict</I>
|
|
|
|
has the value 1.
|
|
(See the discussion of the
|
|
<I>kptr_restrict</I>
|
|
|
|
in
|
|
<B><A HREF="/cgi-bin/man/man2html?5+proc">proc</A></B>(5).)
|
|
|
|
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="156"><B>CAP_WAKE_ALARM</B> (since Linux 3.0)
|
|
|
|
<DD>
|
|
Trigger something that will wake up the system (set
|
|
<B>CLOCK_REALTIME_ALARM</B>
|
|
|
|
and
|
|
<B>CLOCK_BOOTTIME_ALARM</B>
|
|
|
|
timers).
|
|
|
|
</DL>
|
|
<A NAME="lbAE"> </A>
|
|
<H3>Past and current implementation</H3>
|
|
|
|
A full implementation of capabilities requires that:
|
|
<DL COMPACT>
|
|
<DT id="157">1.<DD>
|
|
For all privileged operations,
|
|
the kernel must check whether the thread has the required
|
|
capability in its effective set.
|
|
<DT id="158">2.<DD>
|
|
The kernel must provide system calls allowing a thread's capability sets to
|
|
be changed and retrieved.
|
|
<DT id="159">3.<DD>
|
|
The filesystem must support attaching capabilities to an executable file,
|
|
so that a process gains those capabilities when the file is executed.
|
|
</DL>
|
|
<P>
|
|
|
|
Before kernel 2.6.24, only the first two of these requirements are met;
|
|
since kernel 2.6.24, all three requirements are met.
|
|
|
|
<A NAME="lbAF"> </A>
|
|
<H3>Notes to kernel developers</H3>
|
|
|
|
When adding a new kernel feature that should be governed by a capability,
|
|
consider the following points.
|
|
<DL COMPACT>
|
|
<DT id="160">*<DD>
|
|
The goal of capabilities is divide the power of superuser into pieces,
|
|
such that if a program that has one or more capabilities is compromised,
|
|
its power to do damage to the system would be less than the same program
|
|
running with root privilege.
|
|
<DT id="161">*<DD>
|
|
You have the choice of either creating a new capability for your new feature,
|
|
or associating the feature with one of the existing capabilities.
|
|
In order to keep the set of capabilities to a manageable size,
|
|
the latter option is preferable,
|
|
unless there are compelling reasons to take the former option.
|
|
(There is also a technical limit:
|
|
the size of capability sets is currently limited to 64 bits.)
|
|
<DT id="162">*<DD>
|
|
To determine which existing capability might best be associated
|
|
with your new feature, review the list of capabilities above in order
|
|
to find a "silo" into which your new feature best fits.
|
|
One approach to take is to determine if there are other features
|
|
requiring capabilities that will always be used along with the new feature.
|
|
If the new feature is useless without these other features,
|
|
you should use the same capability as the other features.
|
|
<DT id="163">*<DD>
|
|
<I>Don't</I>
|
|
|
|
choose
|
|
<B>CAP_SYS_ADMIN</B>
|
|
|
|
if you can possibly avoid it!
|
|
A vast proportion of existing capability checks are associated
|
|
with this capability (see the partial list above).
|
|
It can plausibly be called "the new root",
|
|
since on the one hand, it confers a wide range of powers,
|
|
and on the other hand,
|
|
its broad scope means that this is the capability
|
|
that is required by many privileged programs.
|
|
Don't make the problem worse.
|
|
The only new features that should be associated with
|
|
<B>CAP_SYS_ADMIN</B>
|
|
|
|
are ones that
|
|
<I>closely</I>
|
|
|
|
match existing uses in that silo.
|
|
<DT id="164">*<DD>
|
|
If you have determined that it really is necessary to create
|
|
a new capability for your feature,
|
|
don't make or name it as a "single-use" capability.
|
|
Thus, for example, the addition of the highly specific
|
|
<B>CAP_SYS_PACCT</B>
|
|
|
|
was probably a mistake.
|
|
Instead, try to identify and name your new capability as a broader
|
|
silo into which other related future use cases might fit.
|
|
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H3>Thread capability sets</H3>
|
|
|
|
Each thread has the following capability sets containing zero or more
|
|
of the above capabilities:
|
|
<DL COMPACT>
|
|
<DT id="165"><I>Permitted</I>
|
|
|
|
<DD>
|
|
This is a limiting superset for the effective
|
|
capabilities that the thread may assume.
|
|
It is also a limiting superset for the capabilities that
|
|
may be added to the inheritable set by a thread that does not have the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability in its effective set.
|
|
<DT id="166"><DD>
|
|
If a thread drops a capability from its permitted set,
|
|
it can never reacquire that capability (unless it
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)s
|
|
|
|
either a set-user-ID-root program, or
|
|
a program whose associated file capabilities grant that capability).
|
|
<DT id="167"><I>Inheritable</I>
|
|
|
|
<DD>
|
|
This is a set of capabilities preserved across an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
Inheritable capabilities remain inheritable when executing any program,
|
|
and inheritable capabilities are added to the permitted set when executing
|
|
a program that has the corresponding bits set in the file inheritable set.
|
|
<DT id="168"><DD>
|
|
Because inheritable capabilities are not generally preserved across
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
when running as a non-root user, applications that wish to run helper
|
|
programs with elevated capabilities should consider using
|
|
ambient capabilities, described below.
|
|
<DT id="169"><I>Effective</I>
|
|
|
|
<DD>
|
|
This is the set of capabilities used by the kernel to
|
|
perform permission checks for the thread.
|
|
<DT id="170"><I>Bounding</I> (per-thread since Linux 2.6.25)
|
|
|
|
<DD>
|
|
The capability bounding set is a mechanism that can be used
|
|
to limit the capabilities that are gained during
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="171"><DD>
|
|
Since Linux 2.6.25, this is a per-thread capability set.
|
|
In older kernels, the capability bounding set was a system wide attribute
|
|
shared by all threads on the system.
|
|
<DT id="172"><DD>
|
|
<DT id="173"><DD>
|
|
For more details on the capability bounding set, see below.
|
|
<DT id="174"><I>Ambient</I> (since Linux 4.3)
|
|
|
|
<DD>
|
|
|
|
This is a set of capabilities that are preserved across an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
of a program that is not privileged.
|
|
The ambient capability set obeys the invariant that no capability
|
|
can ever be ambient if it is not both permitted and inheritable.
|
|
<DT id="175"><DD>
|
|
The ambient capability set can be directly modified using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2).
|
|
|
|
Ambient capabilities are automatically lowered if either of
|
|
the corresponding permitted or inheritable capabilities is lowered.
|
|
<DT id="176"><DD>
|
|
Executing a program that changes UID or GID due to the
|
|
set-user-ID or set-group-ID bits or executing a program that has
|
|
any file capabilities set will clear the ambient set.
|
|
Ambient capabilities are added to the permitted set and
|
|
assigned to the effective set when
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
is called.
|
|
If ambient capabilities cause a process's permitted and effective
|
|
capabilities to increase during an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
this does not trigger the secure-execution mode described in
|
|
<B><A HREF="/cgi-bin/man/man2html?8+ld.so">ld.so</A></B>(8).
|
|
|
|
</DL>
|
|
<P>
|
|
|
|
A child created via
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2)
|
|
|
|
inherits copies of its parent's capability sets.
|
|
See below for a discussion of the treatment of capabilities during
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<P>
|
|
|
|
Using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+capset">capset</A></B>(2),
|
|
|
|
a thread may manipulate its own capability sets (see below).
|
|
<P>
|
|
|
|
Since Linux 3.2, the file
|
|
<I>/proc/sys/kernel/cap_last_cap</I>
|
|
|
|
|
|
exposes the numerical value of the highest capability
|
|
supported by the running kernel;
|
|
this can be used to determine the highest bit
|
|
that may be set in a capability set.
|
|
|
|
<A NAME="lbAH"> </A>
|
|
<H3>File capabilities</H3>
|
|
|
|
Since kernel 2.6.24, the kernel supports
|
|
associating capability sets with an executable file using
|
|
<B><A HREF="/cgi-bin/man/man2html?8+setcap">setcap</A></B>(8).
|
|
|
|
The file capability sets are stored in an extended attribute (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setxattr">setxattr</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?7+xattr">xattr</A></B>(7))
|
|
|
|
named
|
|
<I>security.capability</I>.
|
|
|
|
Writing to this extended attribute requires the
|
|
<B>CAP_SETFCAP</B>
|
|
|
|
capability.
|
|
The file capability sets,
|
|
in conjunction with the capability sets of the thread,
|
|
determine the capabilities of a thread after an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<P>
|
|
|
|
The three file capability sets are:
|
|
<DL COMPACT>
|
|
<DT id="177"><I>Permitted</I> (formerly known as <I>forced</I>):
|
|
|
|
<DD>
|
|
These capabilities are automatically permitted to the thread,
|
|
regardless of the thread's inheritable capabilities.
|
|
<DT id="178"><I>Inheritable</I> (formerly known as <I>allowed</I>):
|
|
|
|
<DD>
|
|
This set is ANDed with the thread's inheritable set to determine which
|
|
inheritable capabilities are enabled in the permitted set of
|
|
the thread after the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="179"><I>Effective</I>:
|
|
|
|
<DD>
|
|
This is not a set, but rather just a single bit.
|
|
If this bit is set, then during an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
all of the new permitted capabilities for the thread are
|
|
also raised in the effective set.
|
|
If this bit is not set, then after an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
none of the new permitted capabilities is in the new effective set.
|
|
<DT id="180"><DD>
|
|
Enabling the file effective capability bit implies
|
|
that any file permitted or inheritable capability that causes a
|
|
thread to acquire the corresponding permitted capability during an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
(see the transformation rules described below) will also acquire that
|
|
capability in its effective set.
|
|
Therefore, when assigning capabilities to a file
|
|
(<B><A HREF="/cgi-bin/man/man2html?8+setcap">setcap</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_set_file">cap_set_file</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_set_fd">cap_set_fd</A></B>(3)),
|
|
|
|
if we specify the effective flag as being enabled for any capability,
|
|
then the effective flag must also be specified as enabled
|
|
for all other capabilities for which the corresponding permitted or
|
|
inheritable flags is enabled.
|
|
|
|
</DL>
|
|
<A NAME="lbAI"> </A>
|
|
<H3>File capability extended attribute versioning</H3>
|
|
|
|
To allow extensibility,
|
|
the kernel supports a scheme to encode a version number inside the
|
|
<I>security.capability</I>
|
|
|
|
extended attribute that is used to implement file capabilities.
|
|
These version numbers are internal to the implementation,
|
|
and not directly visible to user-space applications.
|
|
To date, the following versions are supported:
|
|
<DL COMPACT>
|
|
<DT id="181"><B>VFS_CAP_REVISION_1</B>
|
|
|
|
<DD>
|
|
This was the original file capability implementation,
|
|
which supported 32-bit masks for file capabilities.
|
|
<DT id="182"><B>VFS_CAP_REVISION_2</B> (since Linux 2.6.25)
|
|
|
|
<DD>
|
|
|
|
This version allows for file capability masks that are 64 bits in size,
|
|
and was necessary as the number of supported capabilities grew beyond 32.
|
|
The kernel transparently continues to support the execution of files
|
|
that have 32-bit version 1 capability masks,
|
|
but when adding capabilities to files that did not previously
|
|
have capabilities, or modifying the capabilities of existing files,
|
|
it automatically uses the version 2 scheme
|
|
(or possibly the version 3 scheme, as described below).
|
|
<DT id="183"><B>VFS_CAP_REVISION_3</B> (since Linux 4.14)
|
|
|
|
<DD>
|
|
|
|
Version 3 file capabilities are provided
|
|
to support namespaced file capabilities (described below).
|
|
<DT id="184"><DD>
|
|
As with version 2 file capabilities,
|
|
version 3 capability masks are 64 bits in size.
|
|
But in addition, the root user ID of namespace is encoded in the
|
|
<I>security.capability</I>
|
|
|
|
extended attribute.
|
|
(A namespace's root user ID is the value that user ID 0
|
|
inside that namespace maps to in the initial user namespace.)
|
|
<DT id="185"><DD>
|
|
Version 3 file capabilities are designed to coexist
|
|
with version 2 capabilities;
|
|
that is, on a modern Linux system,
|
|
there may be some files with version 2 capabilities
|
|
while others have version 3 capabilities.
|
|
</DL>
|
|
<P>
|
|
|
|
Before Linux 4.14,
|
|
the only kind of file capability extended attribute
|
|
that could be attached to a file was a
|
|
<B>VFS_CAP_REVISION_2</B>
|
|
|
|
attribute.
|
|
Since Linux 4.14,
|
|
the version of the
|
|
<I>security.capability</I>
|
|
|
|
extended attribute that is attached to a file
|
|
depends on the circumstances in which the attribute was created.
|
|
<P>
|
|
|
|
Starting with Linux 4.14, a
|
|
<I>security.capability</I>
|
|
|
|
extended attribute is automatically created as (or converted to)
|
|
a version 3
|
|
(<B>VFS_CAP_REVISION_3</B>)
|
|
|
|
attribute if both of the following are true:
|
|
<DL COMPACT>
|
|
<DT id="186">(1)<DD>
|
|
The thread writing the attribute resides in a noninitial user namespace.
|
|
(More precisely: the thread resides in a user namespace other
|
|
than the one from which the underlying filesystem was mounted.)
|
|
<DT id="187">(2)<DD>
|
|
The thread has the
|
|
<B>CAP_SETFCAP</B>
|
|
|
|
capability over the file inode,
|
|
meaning that (a) the thread has the
|
|
<B>CAP_SETFCAP</B>
|
|
|
|
capability in its own user namespace;
|
|
and (b) the UID and GID of the file inode have mappings in
|
|
the writer's user namespace.
|
|
</DL>
|
|
<P>
|
|
|
|
When a
|
|
<B>VFS_CAP_REVISION_3</B>
|
|
|
|
<I>security.capability</I>
|
|
|
|
extended attribute is created, the root user ID of the creating thread's
|
|
user namespace is saved in the extended attribute.
|
|
<P>
|
|
|
|
By contrast, creating or modifying a
|
|
<I>security.capability</I>
|
|
|
|
extended attribute from a privileged
|
|
(<B>CAP_SETFCAP</B>)
|
|
|
|
thread that resides in the
|
|
namespace where the underlying filesystem was mounted
|
|
(this normally means the initial user namespace)
|
|
automatically results in the creation of a version 2
|
|
(<B>VFS_CAP_REVISION_2</B>)
|
|
|
|
attribute.
|
|
<P>
|
|
|
|
Note that the creation of a version 3
|
|
<I>security.capability</I>
|
|
|
|
extended attribute is automatic.
|
|
That is to say, when a user-space application writes
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+setxattr">setxattr</A></B>(2))
|
|
|
|
a
|
|
<I>security.capability</I>
|
|
|
|
attribute in the version 2 format,
|
|
the kernel will automatically create a version 3 attribute
|
|
if the attribute is created in the circumstances described above.
|
|
Correspondingly, when a version 3
|
|
<I>security.capability</I>
|
|
|
|
attribute is retrieved
|
|
(<B><A HREF="/cgi-bin/man/man2html?2+getxattr">getxattr</A></B>(2))
|
|
|
|
by a process that resides inside a user namespace that was created by the
|
|
root user ID (or a descendant of that user namespace),
|
|
the returned attribute is (automatically)
|
|
simplified to appear as a version 2 attribute
|
|
(i.e., the returned value is the size of a version 2 attribute and does
|
|
not include the root user ID).
|
|
These automatic translations mean that no changes are required to
|
|
user-space tools (e.g.,
|
|
<B><A HREF="/cgi-bin/man/man2html?1+setcap">setcap</A></B>(1)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?1+getcap">getcap</A></B>(1))
|
|
|
|
in order for those tools to be used to create and retrieve version 3
|
|
<I>security.capability</I>
|
|
|
|
attributes.
|
|
<P>
|
|
|
|
Note that a file can have either a version 2 or a version 3
|
|
<I>security.capability</I>
|
|
|
|
extended attribute associated with it, but not both:
|
|
creation or modification of the
|
|
<I>security.capability</I>
|
|
|
|
extended attribute will automatically modify the version
|
|
according to the circumstances in which the extended attribute is
|
|
created or modified.
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H3>Transformation of capabilities during execve()</H3>
|
|
|
|
<P>
|
|
|
|
During an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
the kernel calculates the new capabilities of
|
|
the process using the following algorithm:
|
|
<P>
|
|
|
|
|
|
|
|
P'(ambient) = (file is privileged) ? 0 : P(ambient)
|
|
<P>
|
|
P'(permitted) = (P(inheritable) & F(inheritable)) |
|
|
<BR> (F(permitted) & P(bounding)) | P'(ambient)
|
|
<P>
|
|
P'(effective) = F(effective) ? P'(permitted) : P'(ambient)
|
|
<P>
|
|
P'(inheritable) = P(inheritable) [i.e., unchanged]
|
|
<P>
|
|
P'(bounding) = P(bounding) [i.e., unchanged]
|
|
|
|
|
|
<P>
|
|
|
|
where:
|
|
<DL COMPACT><DT id="188"><DD>
|
|
<DL COMPACT>
|
|
<DT id="189">P()<DD>
|
|
denotes the value of a thread capability set before the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
<DT id="190">P'()<DD>
|
|
denotes the value of a thread capability set after the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
<DT id="191">F()<DD>
|
|
denotes a file capability set
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
Note the following details relating to the above capability
|
|
transformation rules:
|
|
<DL COMPACT>
|
|
<DT id="192">*<DD>
|
|
The ambient capability set is present only since Linux 4.3.
|
|
When determining the transformation of the ambient set during
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
a privileged file is one that has capabilities or
|
|
has the set-user-ID or set-group-ID bit set.
|
|
<DT id="193">*<DD>
|
|
Prior to Linux 2.6.25,
|
|
the bounding set was a system-wide attribute shared by all threads.
|
|
That system-wide value was employed to calculate the new permitted set during
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
in the same manner as shown above for
|
|
<I>P(bounding)</I>.
|
|
|
|
</DL>
|
|
<P>
|
|
|
|
<I>Note</I>:
|
|
|
|
during the capability transitions described above,
|
|
file capabilities may be ignored (treated as empty) for the same reasons
|
|
that the set-user-ID and set-group-ID bits are ignored; see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
File capabilities are similarly ignored if the kernel was booted with the
|
|
<I>no_file_caps</I>
|
|
|
|
option.
|
|
<P>
|
|
|
|
<I>Note</I>:
|
|
|
|
according to the rules above,
|
|
if a process with nonzero user IDs performs an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
then any capabilities that are present in
|
|
its permitted and effective sets will be cleared.
|
|
For the treatment of capabilities when a process with a
|
|
user ID of zero performs an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
see below under
|
|
<I>Capabilities and execution of programs by root</I>.
|
|
|
|
|
|
<A NAME="lbAK"> </A>
|
|
<H3>Safety checking for capability-dumb binaries</H3>
|
|
|
|
A capability-dumb binary is an application that has been
|
|
marked to have file capabilities, but has not been converted to use the
|
|
<B><A HREF="/cgi-bin/man/man2html?3+libcap">libcap</A></B>(3)
|
|
|
|
API to manipulate its capabilities.
|
|
(In other words, this is a traditional set-user-ID-root program
|
|
that has been switched to use file capabilities,
|
|
but whose code has not been modified to understand capabilities.)
|
|
For such applications,
|
|
the effective capability bit is set on the file,
|
|
so that the file permitted capabilities are automatically
|
|
enabled in the process effective set when executing the file.
|
|
The kernel recognizes a file which has the effective capability bit set
|
|
as capability-dumb for the purpose of the check described here.
|
|
<P>
|
|
|
|
When executing a capability-dumb binary,
|
|
the kernel checks if the process obtained all permitted capabilities
|
|
that were specified in the file permitted set,
|
|
after the capability transformations described above have been performed.
|
|
(The typical reason why this might
|
|
<I>not</I>
|
|
|
|
occur is that the capability bounding set masked out some
|
|
of the capabilities in the file permitted set.)
|
|
If the process did not obtain the full set of
|
|
file permitted capabilities, then
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
fails with the error
|
|
<B>EPERM</B>.
|
|
|
|
This prevents possible security risks that could arise when
|
|
a capability-dumb application is executed with less privilege that it needs.
|
|
Note that, by definition,
|
|
the application could not itself recognize this problem,
|
|
since it does not employ the
|
|
<B><A HREF="/cgi-bin/man/man2html?3+libcap">libcap</A></B>(3)
|
|
|
|
API.
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H3>Capabilities and execution of programs by root</H3>
|
|
|
|
|
|
|
|
In order to mirror traditional UNIX semantics,
|
|
the kernel performs special treatment of file capabilities when
|
|
a process with UID 0 (root) executes a program and
|
|
when a set-user-ID-root program is executed.
|
|
<P>
|
|
|
|
After having performed any changes to the process effective ID that
|
|
were triggered by the set-user-ID mode bit of the binary---e.g.,
|
|
switching the effective user ID to 0 (root) because
|
|
a set-user-ID-root program was executed---the
|
|
kernel calculates the file capability sets as follows:
|
|
<DL COMPACT>
|
|
<DT id="194">1.<DD>
|
|
If the real or effective user ID of the process is 0 (root),
|
|
then the file inheritable and permitted sets are ignored;
|
|
instead they are notionally considered to be all ones
|
|
(i.e., all capabilities enabled).
|
|
(There is one exception to this behavior, described below in
|
|
<I>Set-user-ID-root programs that have file capabilities</I>.)
|
|
|
|
<DT id="195">2.<DD>
|
|
If the effective user ID of the process is 0 (root) or
|
|
the file effective bit is in fact enabled,
|
|
then the file effective bit is notionally defined to be one (enabled).
|
|
</DL>
|
|
<P>
|
|
|
|
These notional values for the file's capability sets are then used
|
|
as described above to calculate the transformation of the process's
|
|
capabilities during
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<P>
|
|
|
|
Thus, when a process with nonzero UIDs
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)s
|
|
|
|
a set-user-ID-root program that does not have capabilities attached,
|
|
or when a process whose real and effective UIDs are zero
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)s
|
|
|
|
a program, the calculation of the process's new
|
|
permitted capabilities simplifies to:
|
|
<P>
|
|
|
|
|
|
|
|
P'(permitted) = P(inheritable) | P(bounding)
|
|
<P>
|
|
P'(effective) = P'(permitted)
|
|
|
|
|
|
<P>
|
|
|
|
Consequently, the process gains all capabilities in its permitted and
|
|
effective capability sets,
|
|
except those masked out by the capability bounding set.
|
|
(In the calculation of P'(permitted),
|
|
the P'(ambient) term can be simplified away because it is by
|
|
definition a proper subset of P(inheritable).)
|
|
<P>
|
|
|
|
The special treatments of user ID 0 (root) described in this subsection
|
|
can be disabled using the securebits mechanism described below.
|
|
|
|
|
|
<A NAME="lbAM"> </A>
|
|
<H3>Set-user-ID-root programs that have file capabilities</H3>
|
|
|
|
There is one exception to the behavior described under
|
|
<I>Capabilities and execution of programs by root</I>.
|
|
|
|
If (a) the binary that is being executed has capabilities attached and
|
|
(b) the real user ID of the process is
|
|
<I>not</I>
|
|
|
|
0 (root) and
|
|
(c) the effective user ID of the process
|
|
<I>is</I>
|
|
|
|
0 (root), then the file capability bits are honored
|
|
(i.e., they are not notionally considered to be all ones).
|
|
The usual way in which this situation can arise is when executing
|
|
a set-UID-root program that also has file capabilities.
|
|
When such a program is executed,
|
|
the process gains just the capabilities granted by the program
|
|
(i.e., not all capabilities,
|
|
as would occur when executing a set-user-ID-root program
|
|
that does not have any associated file capabilities).
|
|
<P>
|
|
|
|
Note that one can assign empty capability sets to a program file,
|
|
and thus it is possible to create a set-user-ID-root program that
|
|
changes the effective and saved set-user-ID of the process
|
|
that executes the program to 0,
|
|
but confers no capabilities to that process.
|
|
|
|
<A NAME="lbAN"> </A>
|
|
<H3>Capability bounding set</H3>
|
|
|
|
The capability bounding set is a security mechanism that can be used
|
|
to limit the capabilities that can be gained during an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
The bounding set is used in the following ways:
|
|
<DL COMPACT>
|
|
<DT id="196">*<DD>
|
|
During an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
the capability bounding set is ANDed with the file permitted
|
|
capability set, and the result of this operation is assigned to the
|
|
thread's permitted capability set.
|
|
The capability bounding set thus places a limit on the permitted
|
|
capabilities that may be granted by an executable file.
|
|
<DT id="197">*<DD>
|
|
(Since Linux 2.6.25)
|
|
The capability bounding set acts as a limiting superset for
|
|
the capabilities that a thread can add to its inheritable set using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+capset">capset</A></B>(2).
|
|
|
|
This means that if a capability is not in the bounding set,
|
|
then a thread can't add this capability to its
|
|
inheritable set, even if it was in its permitted capabilities,
|
|
and thereby cannot have this capability preserved in its
|
|
permitted set when it
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)s
|
|
|
|
a file that has the capability in its inheritable set.
|
|
</DL>
|
|
<P>
|
|
|
|
Note that the bounding set masks the file permitted capabilities,
|
|
but not the inheritable capabilities.
|
|
If a thread maintains a capability in its inheritable set
|
|
that is not in its bounding set,
|
|
then it can still gain that capability in its permitted set
|
|
by executing a file that has the capability in its inheritable set.
|
|
<P>
|
|
|
|
Depending on the kernel version, the capability bounding set is either
|
|
a system-wide attribute, or a per-process attribute.
|
|
<P>
|
|
|
|
<B>Capability bounding set from Linux 2.6.25 onward</B>
|
|
|
|
<P>
|
|
|
|
From Linux 2.6.25, the
|
|
<I>capability bounding set</I>
|
|
|
|
is a per-thread attribute.
|
|
(The system-wide capability bounding set described below no longer exists.)
|
|
<P>
|
|
|
|
The bounding set is inherited at
|
|
<B><A HREF="/cgi-bin/man/man2html?2+fork">fork</A></B>(2)
|
|
|
|
from the thread's parent, and is preserved across an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<P>
|
|
|
|
A thread may remove capabilities from its capability bounding set using the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2)
|
|
|
|
<B>PR_CAPBSET_DROP</B>
|
|
|
|
operation, provided it has the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability.
|
|
Once a capability has been dropped from the bounding set,
|
|
it cannot be restored to that set.
|
|
A thread can determine if a capability is in its bounding set using the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2)
|
|
|
|
<B>PR_CAPBSET_READ</B>
|
|
|
|
operation.
|
|
<P>
|
|
|
|
Removing capabilities from the bounding set is supported only if file
|
|
capabilities are compiled into the kernel.
|
|
In kernels before Linux 2.6.33,
|
|
file capabilities were an optional feature configurable via the
|
|
<B>CONFIG_SECURITY_FILE_CAPABILITIES</B>
|
|
|
|
option.
|
|
Since Linux 2.6.33,
|
|
|
|
the configuration option has been removed
|
|
and file capabilities are always part of the kernel.
|
|
When file capabilities are compiled into the kernel, the
|
|
<B>init</B>
|
|
|
|
process (the ancestor of all processes) begins with a full bounding set.
|
|
If file capabilities are not compiled into the kernel, then
|
|
<B>init</B>
|
|
|
|
begins with a full bounding set minus
|
|
<B>CAP_SETPCAP</B>,
|
|
|
|
because this capability has a different meaning when there are
|
|
no file capabilities.
|
|
<P>
|
|
|
|
Removing a capability from the bounding set does not remove it
|
|
from the thread's inheritable set.
|
|
However it does prevent the capability from being added
|
|
back into the thread's inheritable set in the future.
|
|
<P>
|
|
|
|
<B>Capability bounding set prior to Linux 2.6.25</B>
|
|
|
|
<P>
|
|
|
|
In kernels before 2.6.25, the capability bounding set is a system-wide
|
|
attribute that affects all threads on the system.
|
|
The bounding set is accessible via the file
|
|
<I>/proc/sys/kernel/cap-bound</I>.
|
|
|
|
(Confusingly, this bit mask parameter is expressed as a
|
|
signed decimal number in
|
|
<I>/proc/sys/kernel/cap-bound</I>.)
|
|
|
|
<P>
|
|
|
|
Only the
|
|
<B>init</B>
|
|
|
|
process may set capabilities in the capability bounding set;
|
|
other than that, the superuser (more precisely: a process with the
|
|
<B>CAP_SYS_MODULE</B>
|
|
|
|
capability) may only clear capabilities from this set.
|
|
<P>
|
|
|
|
On a standard system the capability bounding set always masks out the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability.
|
|
To remove this restriction (dangerous!), modify the definition of
|
|
<B>CAP_INIT_EFF_SET</B>
|
|
|
|
in
|
|
<I>include/linux/capability.h</I>
|
|
|
|
and rebuild the kernel.
|
|
<P>
|
|
|
|
The system-wide capability bounding set feature was added
|
|
to Linux starting with kernel version 2.2.11.
|
|
|
|
|
|
|
|
<A NAME="lbAO"> </A>
|
|
<H3>Effect of user ID changes on capabilities</H3>
|
|
|
|
To preserve the traditional semantics for transitions between
|
|
0 and nonzero user IDs,
|
|
the kernel makes the following changes to a thread's capability
|
|
sets on changes to the thread's real, effective, saved set,
|
|
and filesystem user IDs (using
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setuid">setuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setresuid">setresuid</A></B>(2),
|
|
|
|
or similar):
|
|
<DL COMPACT>
|
|
<DT id="198">1.<DD>
|
|
If one or more of the real, effective or saved set user IDs
|
|
was previously 0, and as a result of the UID changes all of these IDs
|
|
have a nonzero value,
|
|
then all capabilities are cleared from the permitted, effective, and ambient
|
|
capability sets.
|
|
<DT id="199">2.<DD>
|
|
If the effective user ID is changed from 0 to nonzero,
|
|
then all capabilities are cleared from the effective set.
|
|
<DT id="200">3.<DD>
|
|
If the effective user ID is changed from nonzero to 0,
|
|
then the permitted set is copied to the effective set.
|
|
<DT id="201">4.<DD>
|
|
If the filesystem user ID is changed from 0 to nonzero (see
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setfsuid">setfsuid</A></B>(2)),
|
|
|
|
then the following capabilities are cleared from the effective set:
|
|
<B>CAP_CHOWN</B>,
|
|
|
|
<B>CAP_DAC_OVERRIDE</B>,
|
|
|
|
<B>CAP_DAC_READ_SEARCH</B>,
|
|
|
|
<B>CAP_FOWNER</B>,
|
|
|
|
<B>CAP_FSETID</B>,
|
|
|
|
<B>CAP_LINUX_IMMUTABLE</B>
|
|
|
|
(since Linux 2.6.30),
|
|
<B>CAP_MAC_OVERRIDE</B>,
|
|
|
|
and
|
|
<B>CAP_MKNOD</B>
|
|
|
|
(since Linux 2.6.30).
|
|
If the filesystem UID is changed from nonzero to 0,
|
|
then any of these capabilities that are enabled in the permitted set
|
|
are enabled in the effective set.
|
|
</DL>
|
|
<P>
|
|
|
|
If a thread that has a 0 value for one or more of its user IDs wants
|
|
to prevent its permitted capability set being cleared when it resets
|
|
all of its user IDs to nonzero values, it can do so using the
|
|
<B>SECBIT_KEEP_CAPS</B>
|
|
|
|
securebits flag described below.
|
|
|
|
<A NAME="lbAP"> </A>
|
|
<H3>Programmatically adjusting capability sets</H3>
|
|
|
|
A thread can retrieve and change its permitted, effective, and inheritable
|
|
capability sets using the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+capget">capget</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+capset">capset</A></B>(2)
|
|
|
|
system calls.
|
|
However, the use of
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_get_proc">cap_get_proc</A></B>(3)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_set_proc">cap_set_proc</A></B>(3),
|
|
|
|
both provided in the
|
|
<I>libcap</I>
|
|
|
|
package,
|
|
is preferred for this purpose.
|
|
The following rules govern changes to the thread capability sets:
|
|
<DL COMPACT>
|
|
<DT id="202">1.<DD>
|
|
If the caller does not have the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability,
|
|
the new inheritable set must be a subset of the combination
|
|
of the existing inheritable and permitted sets.
|
|
<DT id="203">2.<DD>
|
|
(Since Linux 2.6.25)
|
|
The new inheritable set must be a subset of the combination of the
|
|
existing inheritable set and the capability bounding set.
|
|
<DT id="204">3.<DD>
|
|
The new permitted set must be a subset of the existing permitted set
|
|
(i.e., it is not possible to acquire permitted capabilities
|
|
that the thread does not currently have).
|
|
<DT id="205">4.<DD>
|
|
The new effective set must be a subset of the new permitted set.
|
|
</DL>
|
|
<A NAME="lbAQ"> </A>
|
|
<H3>The securebits flags: establishing a capabilities-only environment</H3>
|
|
|
|
|
|
|
|
|
|
Starting with kernel 2.6.26,
|
|
and with a kernel in which file capabilities are enabled,
|
|
Linux implements a set of per-thread
|
|
<I>securebits</I>
|
|
|
|
flags that can be used to disable special handling of capabilities for UID 0
|
|
(<I>root</I>).
|
|
|
|
These flags are as follows:
|
|
<DL COMPACT>
|
|
<DT id="206"><B>SECBIT_KEEP_CAPS</B>
|
|
|
|
<DD>
|
|
Setting this flag allows a thread that has one or more 0 UIDs to retain
|
|
capabilities in its permitted set
|
|
when it switches all of its UIDs to nonzero values.
|
|
If this flag is not set,
|
|
then such a UID switch causes the thread to lose all permitted capabilities.
|
|
This flag is always cleared on an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
<DT id="207"><DD>
|
|
Note that even with the
|
|
<B>SECBIT_KEEP_CAPS</B>
|
|
|
|
flag set, the effective capabilities of a thread are cleared when it
|
|
switches its effective UID to a nonzero value.
|
|
However,
|
|
if the thread has set this flag and its effective UID is already nonzero,
|
|
and the thread subsequently switches all other UIDs to nonzero values,
|
|
then the effective capabilities will not be cleared.
|
|
<DT id="208"><DD>
|
|
The setting of the
|
|
<B>SECBIT_KEEP_CAPS</B>
|
|
|
|
flag is ignored if the
|
|
<B>SECBIT_NO_SETUID_FIXUP</B>
|
|
|
|
flag is set.
|
|
(The latter flag provides a superset of the effect of the former flag.)
|
|
<DT id="209"><DD>
|
|
This flag provides the same functionality as the older
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2)
|
|
|
|
<B>PR_SET_KEEPCAPS</B>
|
|
|
|
operation.
|
|
<DT id="210"><B>SECBIT_NO_SETUID_FIXUP</B>
|
|
|
|
<DD>
|
|
Setting this flag stops the kernel from adjusting the process's
|
|
permitted, effective, and ambient capability sets when
|
|
the thread's effective and filesystem UIDs are switched between
|
|
zero and nonzero values.
|
|
(See the subsection
|
|
<I>Effect of user ID changes on capabilities</I>.)
|
|
|
|
<DT id="211"><B>SECBIT_NOROOT</B>
|
|
|
|
<DD>
|
|
If this bit is set, then the kernel does not grant capabilities
|
|
when a set-user-ID-root program is executed, or when a process with
|
|
an effective or real UID of 0 calls
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2).
|
|
|
|
(See the subsection
|
|
<I>Capabilities and execution of programs by root</I>.)
|
|
|
|
<DT id="212"><B>SECBIT_NO_CAP_AMBIENT_RAISE</B>
|
|
|
|
<DD>
|
|
Setting this flag disallows raising ambient capabilities via the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2)
|
|
|
|
<B>PR_CAP_AMBIENT_RAISE</B>
|
|
|
|
operation.
|
|
</DL>
|
|
<P>
|
|
|
|
Each of the above "base" flags has a companion "locked" flag.
|
|
Setting any of the "locked" flags is irreversible,
|
|
and has the effect of preventing further changes to the
|
|
corresponding "base" flag.
|
|
The locked flags are:
|
|
<B>SECBIT_KEEP_CAPS_LOCKED</B>,
|
|
|
|
<B>SECBIT_NO_SETUID_FIXUP_LOCKED</B>,
|
|
|
|
<B>SECBIT_NOROOT_LOCKED</B>,
|
|
|
|
and
|
|
<B>SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED</B>.
|
|
|
|
<P>
|
|
|
|
The
|
|
<I>securebits</I>
|
|
|
|
flags can be modified and retrieved using the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2)
|
|
|
|
<B>PR_SET_SECUREBITS</B>
|
|
|
|
and
|
|
<B>PR_GET_SECUREBITS</B>
|
|
|
|
operations.
|
|
The
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability is required to modify the flags.
|
|
Note that the
|
|
<B>SECBIT_*</B>
|
|
|
|
constants are available only after including the
|
|
<I><<A HREF="file:///usr/include/linux/securebits.h">linux/securebits.h</A>></I>
|
|
|
|
header file.
|
|
<P>
|
|
|
|
The
|
|
<I>securebits</I>
|
|
|
|
flags are inherited by child processes.
|
|
During an
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2),
|
|
|
|
all of the flags are preserved, except
|
|
<B>SECBIT_KEEP_CAPS</B>
|
|
|
|
which is always cleared.
|
|
<P>
|
|
|
|
An application can use the following call to lock itself,
|
|
and all of its descendants,
|
|
into an environment where the only way of gaining capabilities
|
|
is by executing a program with associated file capabilities:
|
|
<P>
|
|
|
|
|
|
|
|
prctl(PR_SET_SECUREBITS,
|
|
<BR> /* SECBIT_KEEP_CAPS off */
|
|
<BR> SECBIT_KEEP_CAPS_LOCKED |
|
|
<BR> SECBIT_NO_SETUID_FIXUP |
|
|
<BR> SECBIT_NO_SETUID_FIXUP_LOCKED |
|
|
<BR> SECBIT_NOROOT |
|
|
<BR> SECBIT_NOROOT_LOCKED);
|
|
<BR> /* Setting/locking SECBIT_NO_CAP_AMBIENT_RAISE
|
|
<BR> is not required */
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAR"> </A>
|
|
<H3>Per-user-namespace set-user-ID-root programs</H3>
|
|
|
|
A set-user-ID program whose UID matches the UID that
|
|
created a user namespace will confer capabilities
|
|
in the process's permitted and effective sets
|
|
when executed by any process inside that namespace
|
|
or any descendant user namespace.
|
|
<P>
|
|
|
|
The rules about the transformation of the process's capabilities during the
|
|
<B><A HREF="/cgi-bin/man/man2html?2+execve">execve</A></B>(2)
|
|
|
|
are exactly as described in the subsections
|
|
<I>Transformation of capabilities during execve()</I>
|
|
|
|
and
|
|
<I>Capabilities and execution of programs by root</I>,
|
|
|
|
with the difference that, in the latter subsection, "root"
|
|
is the UID of the creator of the user namespace.
|
|
|
|
|
|
<A NAME="lbAS"> </A>
|
|
<H3>Namespaced file capabilities</H3>
|
|
|
|
|
|
Traditional (i.e., version 2) file capabilities associate
|
|
only a set of capability masks with a binary executable file.
|
|
When a process executes a binary with such capabilities,
|
|
it gains the associated capabilities (within its user namespace)
|
|
as per the rules described above in
|
|
"Transformation of capabilities during execve()".
|
|
<P>
|
|
|
|
Because version 2 file capabilities confer capabilities to
|
|
the executing process regardless of which user namespace it resides in,
|
|
only privileged processes are permitted to associate capabilities with a file.
|
|
Here, "privileged" means a process that has the
|
|
<B>CAP_SETFCAP</B>
|
|
|
|
capability in the user namespace where the filesystem was mounted
|
|
(normally the initial user namespace).
|
|
This limitation renders file capabilities useless for certain use cases.
|
|
For example, in user-namespaced containers,
|
|
it can be desirable to be able to create a binary that
|
|
confers capabilities only to processes executed inside that container,
|
|
but not to processes that are executed outside the container.
|
|
<P>
|
|
|
|
Linux 4.14 added so-called namespaced file capabilities
|
|
to support such use cases.
|
|
Namespaced file capabilities are recorded as version 3 (i.e.,
|
|
<B>VFS_CAP_REVISION_3</B>)
|
|
|
|
<I>security.capability</I>
|
|
|
|
extended attributes.
|
|
Such an attribute is automatically created in the circumstances described
|
|
above under "File capability extended attribute versioning".
|
|
When a version 3
|
|
<I>security.capability</I>
|
|
|
|
extended attribute is created,
|
|
the kernel records not just the capability masks in the extended attribute,
|
|
but also the namespace root user ID.
|
|
<P>
|
|
|
|
As with a binary that has
|
|
<B>VFS_CAP_REVISION_2</B>
|
|
|
|
file capabilities, a binary with
|
|
<B>VFS_CAP_REVISION_3</B>
|
|
|
|
file capabilities confers capabilities to a process during
|
|
<B>execve</B>().
|
|
|
|
However, capabilities are conferred only if the binary is executed by
|
|
a process that resides in a user namespace whose
|
|
UID 0 maps to the root user ID that is saved in the extended attribute,
|
|
or when executed by a process that resides in a descendant of such a namespace.
|
|
|
|
|
|
<A NAME="lbAT"> </A>
|
|
<H3>Interaction with user namespaces</H3>
|
|
|
|
For further information on the interaction of
|
|
capabilities and user namespaces, see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+user_namespaces">user_namespaces</A></B>(7).
|
|
|
|
<A NAME="lbAU"> </A>
|
|
<H2>CONFORMING TO</H2>
|
|
|
|
<P>
|
|
|
|
No standards govern capabilities, but the Linux capability implementation
|
|
is based on the withdrawn POSIX.1e draft standard; see
|
|
|
|
|
|
<A NAME="lbAV"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
When attempting to
|
|
<B><A HREF="/cgi-bin/man/man2html?1+strace">strace</A></B>(1)
|
|
|
|
binaries that have capabilities (or set-user-ID-root binaries),
|
|
you may find the
|
|
<I>-u <username></I>
|
|
|
|
option useful.
|
|
Something like:
|
|
<P>
|
|
|
|
|
|
|
|
$ <B>sudo strace -o trace.log -u ceci ./myprivprog</B>
|
|
|
|
|
|
<P>
|
|
|
|
From kernel 2.5.27 to kernel 2.6.26,
|
|
|
|
|
|
capabilities were an optional kernel component,
|
|
and could be enabled/disabled via the
|
|
<B>CONFIG_SECURITY_CAPABILITIES</B>
|
|
|
|
kernel configuration option.
|
|
<P>
|
|
|
|
The
|
|
<I>/proc/[pid]/task/TID/status</I>
|
|
|
|
file can be used to view the capability sets of a thread.
|
|
The
|
|
<I>/proc/[pid]/status</I>
|
|
|
|
file shows the capability sets of a process's main thread.
|
|
Before Linux 3.8, nonexistent capabilities were shown as being
|
|
enabled (1) in these sets.
|
|
Since Linux 3.8,
|
|
|
|
all nonexistent capabilities (above
|
|
<B>CAP_LAST_CAP</B>)
|
|
|
|
are shown as disabled (0).
|
|
<P>
|
|
|
|
The
|
|
<I>libcap</I>
|
|
|
|
package provides a suite of routines for setting and
|
|
getting capabilities that is more comfortable and less likely
|
|
to change than the interface provided by
|
|
<B><A HREF="/cgi-bin/man/man2html?2+capset">capset</A></B>(2)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+capget">capget</A></B>(2).
|
|
|
|
This package also provides the
|
|
<B><A HREF="/cgi-bin/man/man2html?8+setcap">setcap</A></B>(8)
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?8+getcap">getcap</A></B>(8)
|
|
|
|
programs.
|
|
It can be found at
|
|
<BR>
|
|
|
|
|
|
|
|
<P>
|
|
|
|
Before kernel 2.6.24, and from kernel 2.6.24 to kernel 2.6.32 if
|
|
file capabilities are not enabled, a thread with the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability can manipulate the capabilities of threads other than itself.
|
|
However, this is only theoretically possible,
|
|
since no thread ever has
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
in either of these cases:
|
|
<DL COMPACT>
|
|
<DT id="213">*<DD>
|
|
In the pre-2.6.25 implementation the system-wide capability bounding set,
|
|
<I>/proc/sys/kernel/cap-bound</I>,
|
|
|
|
always masks out the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability, and this can not be changed
|
|
without modifying the kernel source and rebuilding the kernel.
|
|
<DT id="214">*<DD>
|
|
If file capabilities are disabled (i.e., the kernel
|
|
<B>CONFIG_SECURITY_FILE_CAPABILITIES</B>
|
|
|
|
option is disabled), then
|
|
<B>init</B>
|
|
|
|
starts out with the
|
|
<B>CAP_SETPCAP</B>
|
|
|
|
capability removed from its per-process bounding
|
|
set, and that bounding set is inherited by all other processes
|
|
created on the system.
|
|
</DL>
|
|
<A NAME="lbAW"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+capsh">capsh</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+setpriv">setpriv</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+prctl">prctl</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+setfsuid">setfsuid</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_clear">cap_clear</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_copy_ext">cap_copy_ext</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_from_text">cap_from_text</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_get_file">cap_get_file</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_get_proc">cap_get_proc</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+cap_init">cap_init</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+capgetp">capgetp</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+capsetp">capsetp</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+libcap">libcap</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?5+proc">proc</A></B>(5),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+credentials">credentials</A></B>(7),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+pthreads">pthreads</A></B>(7),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?7+user_namespaces">user_namespaces</A></B>(7),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+captest">captest</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+filecap">filecap</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+getcap">getcap</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+netcap">netcap</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+pscap">pscap</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+setcap">setcap</A></B>(8)
|
|
|
|
<P>
|
|
|
|
<I>include/linux/capability.h</I>
|
|
|
|
in the Linux kernel source tree
|
|
<A NAME="lbAX"> </A>
|
|
<H2>COLOPHON</H2>
|
|
|
|
This page is part of release 5.05 of the Linux
|
|
<I>man-pages</I>
|
|
|
|
project.
|
|
A description of the project,
|
|
information about reporting bugs,
|
|
and the latest version of this page,
|
|
can be found at
|
|
<A HREF="https://www.kernel.org/doc/man-pages/.">https://www.kernel.org/doc/man-pages/.</A>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="215"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="216"><A HREF="#lbAC">DESCRIPTION</A><DD>
|
|
<DL>
|
|
<DT id="217"><A HREF="#lbAD">Capabilities list</A><DD>
|
|
<DT id="218"><A HREF="#lbAE">Past and current implementation</A><DD>
|
|
<DT id="219"><A HREF="#lbAF">Notes to kernel developers</A><DD>
|
|
<DT id="220"><A HREF="#lbAG">Thread capability sets</A><DD>
|
|
<DT id="221"><A HREF="#lbAH">File capabilities</A><DD>
|
|
<DT id="222"><A HREF="#lbAI">File capability extended attribute versioning</A><DD>
|
|
<DT id="223"><A HREF="#lbAJ">Transformation of capabilities during execve()</A><DD>
|
|
<DT id="224"><A HREF="#lbAK">Safety checking for capability-dumb binaries</A><DD>
|
|
<DT id="225"><A HREF="#lbAL">Capabilities and execution of programs by root</A><DD>
|
|
<DT id="226"><A HREF="#lbAM">Set-user-ID-root programs that have file capabilities</A><DD>
|
|
<DT id="227"><A HREF="#lbAN">Capability bounding set</A><DD>
|
|
<DT id="228"><A HREF="#lbAO">Effect of user ID changes on capabilities</A><DD>
|
|
<DT id="229"><A HREF="#lbAP">Programmatically adjusting capability sets</A><DD>
|
|
<DT id="230"><A HREF="#lbAQ">The securebits flags: establishing a capabilities-only environment</A><DD>
|
|
<DT id="231"><A HREF="#lbAR">Per-user-namespace set-user-ID-root programs</A><DD>
|
|
<DT id="232"><A HREF="#lbAS">Namespaced file capabilities</A><DD>
|
|
<DT id="233"><A HREF="#lbAT">Interaction with user namespaces</A><DD>
|
|
</DL>
|
|
<DT id="234"><A HREF="#lbAU">CONFORMING TO</A><DD>
|
|
<DT id="235"><A HREF="#lbAV">NOTES</A><DD>
|
|
<DT id="236"><A HREF="#lbAW">SEE ALSO</A><DD>
|
|
<DT id="237"><A HREF="#lbAX">COLOPHON</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:07 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|