Notes Linux capabilities sécurité caps capsh setcap

Voir :

• Les capabilities sous Linux
• Linux capabilities : se passer des commandes su et sudo

man 7 capabilities

capsh --print
getpcaps $$

$ dpkg -L libcap-ng-utils | grep 'bin/'
/usr/bin/captest
/usr/bin/filecap
/usr/bin/netcap
/usr/bin/pscap

Voir :

• Serveur en écoute sur un port inférieur à 1024 sans utiliser root ni setuid grâce aux capabilities setcap

Autoriser les utilisateur non-root à utiliser tcpdump

NOTE : il est aussi possible d'utiliser le sudoer

Source : https://askubuntu.com/questions/530920/tcpdump-permissions-problem

Add a capture group and add yourself to it:

sudo groupadd pcap
sudo usermod -a -G pcap $USER

Next, change the group of tcpdump and set permissions:

sudo chgrp pcap /usr/sbin/tcpdump
sudo chmod 750 /usr/sbin/tcpdump

Finally, use setcap to give tcpdump the necessary permissions:

sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

Be careful, that this will allow everybody from the group pcap to manipulate network interfaces and read raw packets!

Voir :

• /etc/security/capability.conf
• libcap

Exemple

coredns.service

[Unit]
Description=CoreDNS Server
Documentation=https://coredns.io/manual/
After=network-online.target
Wants=network-online.target
 
[Service]
User=coredns
Group=coredns
AmbientCapabilities=CAP_NET_BIND_SERVICE
Restart=always
WorkingDirectory=/etc/coredns
ExecStart=/usr/bin/coredns 
ExecReload=/usr/bin/kill -USR1 $MAINPID
 
[Install]
WantedBy=multi-user.target

Source : https://gorbe.io/posts/coredns/install/

Source : https://docs.syncthing.net/advanced/folder-sync-ownership

sudo chown root /usr/local/bin/syncthing
sudo chmod 755 /usr/local/bin/syncthing
sudo setcap CAP_CHOWN,CAP_FOWNER=pe /usr/local/bin/syncthing

nerdctl run -ti --rm --cap-drop=all docker.io/jess/amicontained /bin/sh

crictl inspect 6142ce06b10d6