3 ms·

Nice article. I'd like to make 2 additions: #1: I disagree with the very first sentence ("Capabilities are being use more and more, mainly thanks to SystemD,

Nice article. I'd like to make 2 additions: #1: I disagree with the very first sentence ("Capabilities are being use more and more, mainly thanks to SystemD, Docker and orchestrators like Kubernetes.") - a lot of old-fashioned daemons already use capabilities to limit their privileges and/or raise and lower them as needed. #2: pspax from pax-utils is a great tool to show process capabilities: # pspax USER PID PAX MAPS ETYPE NAME CAPS ATTR root 1 --- w^x ET_DYN init =ep system_u:system_r:init_t:s0 root 2575 --- w^x ET_DYN udevd =ep system_u:system_r:kernel_t:s0 root 2752 --- w^x ET_DYN dmeventd =ep system_u:system_r:kernel_t:s0 root 60844 --- w^x ET_DYN auditd =ep system_u:system_r:kernel_t:s0 root 60879 --- w^x ET_DYN crond =ep system_u:system_r:kernel_t:s0 root 60910 --- w^x ET_DYN ntpd cap_net_bind_service,cap_ipc_lock,cap_sys_time=ep system_u:system_r:kernel_t:s0 root 61532 --- w^x ET_DYN lxc-start =ep system_u:system_r:kernel_t:s0 -------- 61542 --- w^x ET_EXEC init =eip system_u:system_r:kernel_t:s0 root 66327 --- w^x ET_DYN lxc-start =ep system_u:system_r:kernel_t:s0 -------- 66328 --- w^x ET_EXEC init =eip system_u:system_r:kernel_t:s0 root 70543 --- w^x ET_DYN zebra cap_net_admin,cap_net_raw,cap_sys_admin=p system_u:system_r:kernel_t:s0 root 70785 --- w^x ET_DYN ospfd cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_admin=p system_u:system_r:kernel_t:s0 root 70794 --- w^x ET_DYN ospf6d cap_net_bind_service,cap_net_raw=p system_u:system_r:kernel_t:s0 root 71529 --- w^x ET_DYN bgpd cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_admin=p system_u:system_r:kernel_t:s0 root 71770 --- w^x ET_DYN syslog-ng =ep system_u:system_r:kernel_t:s0 root 71771 --- w^x ET_DYN syslog-ng cap_syslog=ep cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_net_bind_service,cap_net_broadcast,cap_net_raw+p system_u:system_r:kernel_t:s0 [...] (Note: in some versions of pspax, this is unfortunately broken; if you see everything with only "=ep", that's probably not right.)

neop1x 6y ago
Interesting, pax-utils-v1.2.5 on Arch Linux 5.10.9-arch1-1: > pspax USER PID PAX MAPS ETYPE NAME CAPS ATTR [1] 3209832 invalid system call (core dumped) pspax Stack trace of thread 3209832: #0 0x00007fbdb92d89ab __socket (libc.so.6 + 0x1019ab) #1 0x00007fbdb930dce0 open_socket (libc.so.6 + 0x136ce0) #2 0x00007fbdb930e1de __nscd_get_mapping (libc.so.6 + 0x1371de) #3 0x00007fbdb930e62f __nscd_get_map_ref (libc.so.6 + 0x13762f) #4 0x00007fbdb930ac47 nscd_getpw_r (libc.so.6 + 0x133c47) #5 0x00007fbdb930b0b6 __nscd_getpwuid_r (libc.so.6 + 0x1340b6) #6 0x00007fbdb92a3895 getpwuid_r@@GLIBC_2.2.5 (libc.so.6 + 0xcc895) #7 0x00007fbdb92a2eeb getpwuid (libc.so.6 + 0xcbeeb) #8 0x0000558995732566 n/a (pspax + 0x4566) #9 0x00007fbdb91ff152 __libc_start_main (libc.so.6 + 0x28152) #10 0x0000558995732e8e n/a (pspax + 0x4e8e) Dump of assembler code for function socket: 0x00007fb1d04139a0 <+0>: endbr64 0x00007fb1d04139a4 <+4>: mov $0x29,%eax 0x00007fb1d04139a9 <+9>: syscall => 0x00007fb1d04139ab <+11>: cmp $0xfffffffffffff001,%rax 0x00007fb1d04139b1 <+17>: jae 0x7fb1d04139b4 <socket+20> 0x00007fb1d04139b3 <+19>: ret 0x00007fb1d04139b4 <+20>: mov 0xc0495(%rip),%rcx # 0x7fb1d04d3e50 This can be a system library incompatibility though as don't have all system packages up-to-date. The code compiled from https://github.com/gentoo/pax-utils https://github.com/gentoo/pax-utils runs but displays just = under CAPS for every process. So I am not sure it is generally usable outside of Gentoo (yet).
- eqvinox 6y ago
  Took a quick look... can you try this diff? --- pspax.c 2021-02-26 09:46:14.304092510 +0100 +++ pspax.c 2021-02-25 11:25:42.439550015 +0100 @@ -413,7 +413,7 @@ /* this is a non-POSIX function */ caps = NULL; - WRAP_SYSCAP(capgetp(pfd, cap_d)); + WRAP_SYSCAP(cap_d = cap_get_pid(pid)); WRAP_SYSCAP(caps = cap_to_text(cap_d, &length)); if (pwd && strlen(pwd->pw_name) >= 8)
  - neop1x 6y ago
    The problem was I didn't compile it with pcap support initially (it is not enabled by default). It needs: make USE_CAP=yes Then it showed "=ep" for every process BUT your patch fixed it and now it correctly lists process capabilities. According to man, capgetp() is deprecated and cap_get_pid() should be used instead anyway. EDIT: I can see your patch merged upstream, good work! :)

neop1x 6y ago

Interesting, pax-utils-v1.2.5 on Arch Linux 5.10.9-arch1-1: > pspax USER PID PAX MAPS ETYPE NAME CAPS ATTR [1] 3209832 invalid system call (core dumped) pspax Stack trace of thread 3209832: #0 0x00007fbdb92d89ab __socket (libc.so.6 + 0x1019ab) #1 0x00007fbdb930dce0 open_socket (libc.so.6 + 0x136ce0) #2 0x00007fbdb930e1de __nscd_get_mapping (libc.so.6 + 0x1371de) #3 0x00007fbdb930e62f __nscd_get_map_ref (libc.so.6 + 0x13762f) #4 0x00007fbdb930ac47 nscd_getpw_r (libc.so.6 + 0x133c47) #5 0x00007fbdb930b0b6 __nscd_getpwuid_r (libc.so.6 + 0x1340b6) #6 0x00007fbdb92a3895 getpwuid_r@@GLIBC_2.2.5 (libc.so.6 + 0xcc895) #7 0x00007fbdb92a2eeb getpwuid (libc.so.6 + 0xcbeeb) #8 0x0000558995732566 n/a (pspax + 0x4566) #9 0x00007fbdb91ff152 __libc_start_main (libc.so.6 + 0x28152) #10 0x0000558995732e8e n/a (pspax + 0x4e8e) Dump of assembler code for function socket: 0x00007fb1d04139a0 <+0>: endbr64 0x00007fb1d04139a4 <+4>: mov $0x29,%eax 0x00007fb1d04139a9 <+9>: syscall => 0x00007fb1d04139ab <+11>: cmp $0xfffffffffffff001,%rax 0x00007fb1d04139b1 <+17>: jae 0x7fb1d04139b4 <socket+20> 0x00007fb1d04139b3 <+19>: ret 0x00007fb1d04139b4 <+20>: mov 0xc0495(%rip),%rcx # 0x7fb1d04d3e50 This can be a system library incompatibility though as don't have all system packages up-to-date. The code compiled from https://github.com/gentoo/pax-utils https://github.com/gentoo/pax-utils runs but displays just = under CAPS for every process. So I am not sure it is generally usable outside of Gentoo (yet).

eqvinox 6y ago
Took a quick look... can you try this diff? --- pspax.c 2021-02-26 09:46:14.304092510 +0100 +++ pspax.c 2021-02-25 11:25:42.439550015 +0100 @@ -413,7 +413,7 @@ /* this is a non-POSIX function */ caps = NULL; - WRAP_SYSCAP(capgetp(pfd, cap_d)); + WRAP_SYSCAP(cap_d = cap_get_pid(pid)); WRAP_SYSCAP(caps = cap_to_text(cap_d, &length)); if (pwd && strlen(pwd->pw_name) >= 8)
- neop1x 6y ago
  The problem was I didn't compile it with pcap support initially (it is not enabled by default). It needs: make USE_CAP=yes Then it showed "=ep" for every process BUT your patch fixed it and now it correctly lists process capabilities. According to man, capgetp() is deprecated and cap_get_pid() should be used instead anyway. EDIT: I can see your patch merged upstream, good work! :)