Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_linux_capabilities_securite_caps_capsh_setcap [2025/09/30 13:18] – Jean-Baptiste
+++ tech:notes_linux_capabilities_securite_caps_capsh_setcap [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon Linux}}
+# Notes Linux capabilities sécurité caps capsh setcap
+Voir :
+* [Les capabilities sous Linux](http://connect.ed-diamond.com/GNU-Linux-Magazine/GLMF-164/Les-capabilities-sous-Linux)
+* [Linux capabilities : se passer des commandes su et sudo](https://linuxfr.org/news/linux-capabilities-se-passer-des-commandes-su-et-sudo)
+~~~bash
+man 7 capabilities
+~~~
+~~~bash
+capsh --print
+getpcaps $$
+~~~
+~~~
+$ dpkg -L libcap-ng-utils | grep 'bin/'
+/usr/bin/captest
+/usr/bin/filecap
+/usr/bin/netcap
+/usr/bin/pscap
+~~~
+Voir :
+* [[Serveur en écoute sur un port inférieur à 1024 sans utiliser root ni setuid grâce aux capabilities setcap]]
+## tcpdump permission pour non-root
+Autoriser les utilisateur non-root à utiliser tcpdump
+NOTE : il est aussi possible d'utiliser le sudoer
+Source : https://askubuntu.com/questions/530920/tcpdump-permissions-problem
+Add a capture group and add yourself to it:
+~~~bash
+sudo groupadd pcap
+sudo usermod -a -G pcap $USER
+~~~
+Next, change the group of tcpdump and set permissions:
+~~~bash
+sudo chgrp pcap /usr/sbin/tcpdump
+sudo chmod 750 /usr/sbin/tcpdump
+~~~
+Finally, use setcap to give tcpdump the necessary permissions:
+~~~bash
+sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
+~~~
+Be careful, that this will allow everybody from the group pcap to manipulate network interfaces and read raw packets!
+## PAM user
+Voir :
+* /etc/security/capability.conf
+* libcap
+## Service SystemD
+Exemple
+`coredns.service`
+~~~ini
+[Unit]
+Description=CoreDNS Server
+Documentation=https://coredns.io/manual/
+After=network-online.target
+Wants=network-online.target
+[Service]
+User=coredns
+Group=coredns
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+Restart=always
+WorkingDirectory=/etc/coredns
+ExecStart=/usr/bin/coredns
+ExecReload=/usr/bin/kill -USR1 $MAINPID
+[Install]
+WantedBy=multi-user.target
+~~~
+Source : https://gorbe.io/posts/coredns/install/
+## SyncThing - syncOwnership
+Source : https://docs.syncthing.net/advanced/folder-sync-ownership
+~~~bash
+sudo chown root /usr/local/bin/syncthing
+sudo chmod 755 /usr/local/bin/syncthing
+sudo setcap CAP_CHOWN,CAP_FOWNER=pe /usr/local/bin/syncthing
+~~~
+## Autres
+~~~bash
+nerdctl run -ti --rm --cap-drop=all docker.io/jess/amicontained /bin/sh
+~~~
+~~~bash
+crictl inspect 6142ce06b10d6
+~~~