Run Your Applications with Necessary Privileges: Linux Capabilities

Photo by Dimitri Houtteman on Unsplash
If the effective user id is zero or the user space has enough privilege to do this.

How to Run Netcat (on the Port 80) and iftop Without Switching to Root User?

root@adil:~# su - example
example@adil:~$ nc -l -p 80
nc: Permission denied
example@adil:~$ iftop
pcap_open_live(ens3): ens3: You don’t have permission to capture on that device (socket: Operation not permitted)
root@adil:~# setcap cap_net_bind_service+ep /bin/nc.openbsd
root@adil:~# setcap cap_net_raw+ep /usr/sbin/iftop
root@adil:~# su — example
example@adil:~$ nc -l -p 80
example@adil:~$ iftop

What does +ep stand for?

Let’s make some analogies

Analogy #1

Analogy #2

Analogy #3

Let’s go back to the beginning

sudo setcap cap_net_raw+ep /usr/sbin/iftop

Hey, all users can run iftop now. I want to allow only the test1 user run the iftop command.

sudo setcap cap_net_raw+ie /usr/sbin/iftop
root@adil:~# grep test1 /etc/security/capability.conf
cap_net_raw test1
root@adil:~# setcap cap_net_raw=+ie /usr/sbin/iftop
test1@adil:~$ iftop # it is working fine
ubuntu@adil:~$ iftop # it is not working
You don’t have permission to capture on that device (socket: Operation not permitted)
grep Cap /proc/$(pgrep iftop)/status
CapInh: 0000000000002000
CapPrm: 0000000000002000
CapEff: 0000000000002000
CapBnd: 0000003fffffffff
CapAmb: 0000000000000000
root@adil:~# capsh --decode=0000000000002000
0x0000000000002000=cap_net_raw

--

--

--

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Design Patterns: Singleton Pattern

Flash Stock Rom on Gplus x7 pro

Flash Android phone

My journey to cracking AWS Solutions Architect Pro Exam

Faster CI on Modular Android Apps

How I Would Build Uber

Golang Best Practices — Behavior-driven development and Continuous Integration

Why not promoted?

Publishing data in IOTA Tangle with Omega2 and MAM

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
adil

adil

More from Medium

Why is Linux considered the best of all?🤔

Unix Heredoc Cheatsheet

Display informations about the system with lscpu, lspci, lsraid, lsscsi, lsusb, lsmod, lsdev, lsblk…

Linux Fundamentals. Part 2