Questions tagged [capabilities]
A capability is a set of access rights granted to a subject, often transferable. Capabilities are a method for access control.
14
questions
2
votes
0answers
146 views
What are the security implications of capabilities in Kubernetes pods?
We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities:
...
3
votes
2answers
226 views
Difference between linux capabities and seccomp
I know seccomp (secure computing) is a way to restrict a process from making particular system calls.
While linux capabilities provides a way to give privileges to spcific user or process.
So if I ...
3
votes
1answer
387 views
Why do capability-based security systems protect against the confused deputy problem?
According to Wikipedia (https://en.wikipedia.org/wiki/Confused_deputy_problem):
In information security, the confused deputy problem is often cited as
an example of why capability-based security ...
4
votes
2answers
1k views
Docker: when to use apparmor vs seccomp vs --cap-drop
Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container.
However I couldn't find any documentation or guideline on when to use which ...
1
vote
0answers
303 views
Use of S/MIME capabilities attribute
If you examine an S/MIME-signed file with
$ openssl cms -in file.sgn -noout -cmsout -print
you see that S/MIME capabilities are also included in the signature:
...
object: S/MIME Capabilities (1.2....
3
votes
1answer
5k views
Security implications of using SETCAP CAP_NET_RAW
In order to get around the 'problem' of applications requiring root privileges to run, I'm using:
sudo setcap CAP_NET_ADMIN+ep "$(readlink -f /usr/sbin/app)"
sudo setcap CAP_NET_RAW+ep "$(readlink -f ...
2
votes
2answers
344 views
Making a file immutable (against kernel exploits)
I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
4
votes
1answer
334 views
Are Linux System Capabilities Considered Mandatory Access Controls?
DAC is not mandatory because access permissions are left up to the resource owner's discretion.
Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a process/...
2
votes
1answer
676 views
What is the difference between claims and capabilities in access control?
I've read about the differences between capabilities and access control lists, but to me capabilities seem similar to claims. Can anyone explain the difference, if there is one?
4
votes
2answers
1k views
Do `sudo` and `su` belong to capability-based security?
In Linux, do sudo and su belong to Capability-based security ?
For example, when editing a system file, we usually need sudo or su to temporarily switch to user root. Does this example belong to ...
5
votes
1answer
534 views
Capability-based security vs protection rings: in what sense are they diametrically opposite?
From https://en.wikipedia.org/wiki/Capability-based_security
Capability-based security is to be contrasted with an approach that uses hierarchical protection domains.
From https://en.wikipedia.org/...
6
votes
2answers
1k views
Combining capability-based access control with SAML
I have been looking into various research on identity, PKI and access control trying to boil it down to a simplified methodology for IAM (Identity & Access Management).
One thing which pops up in ...
5
votes
2answers
2k views
What are the practical differences between SELinux targeted mode and a capability based OS?
I recently asked a question about the differences between capabilities and mandatory access controls.
Among the answers I got the point was made that systems like SE Linux in targeted mode are not a ...
9
votes
5answers
2k views
What is the practical difference between MAC and Capabilities
Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user.
Is there any ...
