{"id":302,"date":"2010-02-09T11:15:54","date_gmt":"2010-02-09T19:15:54","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=302"},"modified":"2010-02-09T11:15:54","modified_gmt":"2010-02-09T19:15:54","slug":"easy-example-of-fscaps","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2010\/02\/09\/easy-example-of-fscaps\/","title":{"rendered":"easy example of filesystem capabilities"},"content":{"rendered":"<p>Instead of using setuid programs, the goal for the future is to use fine-grained capabilities.  For example, here is <code>\/bin\/ping<\/code>:<\/p>\n<blockquote><p>$ <strong>ls -la \/bin\/ping<\/strong><br \/>\n-rwsr-xr-x 1 root root 35680 2009-11-05 00:41 \/bin\/ping<br \/>\n$ <strong>.\/ping 127.0.0.1<\/strong><br \/>\nPING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.<br \/>\n64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.041 ms<br \/>\n&#8230;<br \/>\n$ <strong>sudo setcap CAP_NET_RAW=ep \/bin\/ping<\/strong><br \/>\n$ <strong>getcap \/bin\/ping<\/strong><br \/>\n\/bin\/ping = cap_net_raw+ep<br \/>\n$ <strong>.\/ping 127.0.0.1<\/strong><br \/>\nPING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.<br \/>\n64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.041 ms<br \/>\n&#8230;<br \/>\n$ <strong>dmesg | tail -n1<\/strong><br \/>\n[212275.772124] warning: `\/bin\/ping&#8217; has both setuid-root and effective capabilities. Therefore not raising all capabilities.\n<\/p><\/blockquote>\n<p>The best part is that the kernel will choose the set of least privileges when both setuid and capabilities exist.  Easy way to transition!<\/p>\n<p style='text-align:left'>&copy; 2010, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Instead of using setuid programs, the goal for the future is to use fine-grained capabilities. For example, here is \/bin\/ping: $ ls -la \/bin\/ping -rwsr-xr-x 1 root root 35680 2009-11-05 00:41 \/bin\/ping $ .\/ping 127.0.0.1 PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.041 ms &#8230; $ sudo setcap CAP_NET_RAW=ep [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,7,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/302"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=302"}],"version-history":[{"count":2,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/302\/revisions"}],"predecessor-version":[{"id":304,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/302\/revisions\/304"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=302"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}