4

What's the best way to compute a minimal set of Linux capabilities for any process?

Suppose you're hardening an operating system and some of you tools may require CAP_NET_ADMIN and related network privileges while other tools may require CAP_SYS_NICE. There should be a way to tell for each executable which capabilities are really required.

milton
  • 988
  • 6
  • 19

1 Answers1

3

Two possible approaches to determine required capabilities at runtime:

  • Subsequently run your program under strace without root privileges. Determine which system calls failed with EPERM and add corresponding capabilities to your program. Repeat this until all capabilities are gathered.
  • Use SystemTap, DTrace or Kprobes to log or intercept capability checks in kernel made for your program. (e.g. use capable from BCC tools suite as described here)

Unit tests with good coverage will help a lot, I guess. Also note that capabilities(7) manual page lists system calls that may require each capability (although it is not a complete list).

Update:

The article referenced by @RodrigoBelem mentions capable_probe module, which is based on KProbes.

Original article with this module was "POSIX file capabilities: Parceling the power of root" and it's not availble now (it was hosted here). But you can find the source code and some docs in the Internet.

tomix86
  • 1,336
  • 2
  • 18
  • 29
gavv
  • 4,649
  • 1
  • 23
  • 40