Linux Basic notes--[020]--"Linux Capability"

"Linux Capability"

For the purpose of performing permission checks, traditional UNIX implementations distinguish, categories of processes: Privileged processes (whose effective user ID is 0, referred to as superuser or root), and unprivileged processes (whose Effective UID is nonzero).

Privileged processes bypass All kernel permission checks, while unprivileged processes is subject to full permission Chec King based on the process ' s credentials (usually:effective UID, effective GID, and supplementary group list).

Starting with kernel 2.2, Linux divides the privileges traditionally associated with superuser into distinct units, known As Capabili‐ties, which can be independently enabled and disabled. Capabilities is a Per-thread attribute.

First, kernel configuration

Second, the source of authority-related comments (/usr/src/linux-*.*.*/include/linux/cred.h):

The three capacity bits of the process are defined: inheritable (I), permitted (P), and effective (E)

• Cap_permitted: When a process performs a privileged operation, the operating system checks if the corresponding bit in cap_effective is valid, and no longer checks whether the process Euid is 0
• Cap_permitted: Represents the ability of a process to actually be used, which can contain capabilities not in Cap_effective in cap_permitted
• Cap_inheritable represents the ability to inherit from a child process that is initiated by the target program

Third, Setcap, Getcap: The use of the user layer, the system has suid, Sgid permissions bits of the file, with a more secure capability mechanism management, reduce the potential of the vulnerability of the program to harm

Find /-perm/4000Find /-perm/

"Application Example One"

Ping requires only cap_net_raw ability to execute in an environment with X permissions and does not require SUID permissions

/ * Cap_net_raw:use RAW and PACKET Sockets;bind to any address for transparent proxying * /

chown u-s/bin/pingroot # setcap cap_net_raw+ep/bin/ping/bin/ Ping/bin/ping = Cap_net_raw+ep

"Application Example II"

Enables ordinary users to perform iftop

Root # Setcap Cap_net_raw+ep/usr/sbin/iftop

"Application Example three"

Enables normal users to switch virtual Workbench using CHVT

Root # Setcap CAP_DAC_READ_SEARCH,CAP_SYS_TTY_CONFIG+EP/USR/BIN/CHVT

　　

Linux Basic notes--[020]--"Linux Capability"