setcap/getcap/setfacl/getfacl/attr
1 | $ dumpcap |
1 | $ sudo setfacl -m u:runsisi:rx /usr/sbin/dumpcap |
1 | $ dumpcap |
A textual representation of capability sets consists of one or more whitespace-separated clauses.
Each clause consists of a list of comma-separated capability names (or the word `all’), followed by an action-list. An action-list consists of a sequence of operator flag pairs.
cap_net_admin+pe-i cap_net_raw=+pe cap_net_admin=ep
1 | $ getcap /usr/bin/ping |
libcap-ng-utils
1 | $ rpm -ql libcap-ng-utils |
systemd AmbientCapabilities
1 | $ systemd-run -t -p "AmbientCapabilities=~" capsh --print |
代码实现
1 | // fs/proc/array.c |
set-ambient
1 |
|
参考资料
man 手册页
https://man7.org/linux/man-pages/man7/capabilities.7.html
Linux 内核 CAP 宏定义
https://github.com/torvalds/linux/blob/v5.9/include/uapi/linux/capability.h
Linux Capabilities in a nutshell
https://k3a.me/linux-capabilities-in-a-nutshell/
Linux Capabilities: Why They Exist and How They Work
https://blog.container-solutions.com/linux-capabilities-why-they-exist-and-how-they-work
Linux Capabilities In Practice
https://blog.container-solutions.com/linux-capabilities-in-practice
Secure Your Containers with this One Weird Trick
https://www.redhat.com/en/blog/secure-your-containers-one-weird-trick
systemd.directives – AmbientCapabilities
https://www.freedesktop.org/software/systemd/man/systemd.directives.html
capabilities: ambient capabilities
https://github.com/torvalds/linux/commit/58319057b7847667f0c
Linux capabilities 101
https://linux-audit.com/linux-capabilities-101/
LINUX CONTAINER BASICS: CAPABILITIES
https://www.schutzwerk.com/en/43/posts/linux_container_capabilities/
Understanding Capabilities in Linux
https://blog.ploetzli.ch/2014/understanding-linux-capabilities/
Making an RPM which sets POSIX files capabilities
https://stackoverflow.com/questions/26898007/making-an-rpm-which-sets-posix-files-capabilities
Linux Capabilities and when to drop all
https://raesene.github.io/blog/2017/08/27/Linux-capabilities-and-when-to-drop-all/
dist/redhat: Disables ambient capabilities when systemd/kernel doesn’t support it
https://github.com/scylladb/scylla/commit/fcc1a9f6bb35dc99c0f5d0d1a9eae2f3b5218fbd