{{tag>Brouillon Linux}} # Notes Linux capabilities sécurité caps capsh setcap Voir : * [Les capabilities sous Linux](http://connect.ed-diamond.com/GNU-Linux-Magazine/GLMF-164/Les-capabilities-sous-Linux) * [Linux capabilities : se passer des commandes su et sudo](https://linuxfr.org/news/linux-capabilities-se-passer-des-commandes-su-et-sudo) ~~~bash man 7 capabilities ~~~ ~~~bash capsh --print getpcaps $$ ~~~ ~~~ $ dpkg -L libcap-ng-utils | grep 'bin/' /usr/bin/captest /usr/bin/filecap /usr/bin/netcap /usr/bin/pscap ~~~ Voir : * [[Serveur en écoute sur un port inférieur à 1024 sans utiliser root ni setuid grâce aux capabilities setcap]] ## tcpdump permission pour non-root Autoriser les utilisateur non-root à utiliser tcpdump NOTE : il est aussi possible d'utiliser le sudoer Source : https://askubuntu.com/questions/530920/tcpdump-permissions-problem Add a capture group and add yourself to it: ~~~bash sudo groupadd pcap sudo usermod -a -G pcap $USER ~~~ Next, change the group of tcpdump and set permissions: ~~~bash sudo chgrp pcap /usr/sbin/tcpdump sudo chmod 750 /usr/sbin/tcpdump ~~~ Finally, use setcap to give tcpdump the necessary permissions: ~~~bash sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump ~~~ Be careful, that this will allow everybody from the group pcap to manipulate network interfaces and read raw packets! ## PAM user Voir : * /etc/security/capability.conf * libcap ## Service SystemD Exemple `coredns.service` ~~~ini [Unit] Description=CoreDNS Server Documentation=https://coredns.io/manual/ After=network-online.target Wants=network-online.target [Service] User=coredns Group=coredns AmbientCapabilities=CAP_NET_BIND_SERVICE Restart=always WorkingDirectory=/etc/coredns ExecStart=/usr/bin/coredns ExecReload=/usr/bin/kill -USR1 $MAINPID [Install] WantedBy=multi-user.target ~~~ Source : https://gorbe.io/posts/coredns/install/ ## SyncThing - syncOwnership Source : https://docs.syncthing.net/advanced/folder-sync-ownership ~~~bash sudo chown root /usr/local/bin/syncthing sudo chmod 755 /usr/local/bin/syncthing sudo setcap CAP_CHOWN,CAP_FOWNER=pe /usr/local/bin/syncthing ~~~ ## Autres ~~~bash nerdctl run -ti --rm --cap-drop=all docker.io/jess/amicontained /bin/sh ~~~ ~~~bash crictl inspect 6142ce06b10d6 ~~~