Questions tagged [capabilities]

A capability is a set of access rights granted to a subject, often transferable. Capabilities are a method for access control.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

ptrace: Permission denied with SYS_PTRACE capability [closed]

I have created a pod whose container has the SYS_PTRACE capability (and the SYS_ADMIN) When I am attempting to attach to another process, gdb -p 12345 Attaching to process 12345 ptrace: Permission ...
pkaramol's user avatar
  • 103
0 votes
0 answers
15 views

Unable to vew /proc/1/environ despite having SYS_ADMIN capability [closed]

I have created a kubernetes pod. The container has the SYS_ADMIN capability. I can see all host's processes. However I can not cat /proc/1/environ. Why is that?
pkaramol's user avatar
  • 103
5 votes
1 answer
1k views

Explanation of capabilities: CAP_NET_BIND_SERVICE

I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain. I am in a VM (Kali). ❯ uname -a ...
cactuschibre's user avatar
0 votes
1 answer
158 views

Capabilities DROP in container of Kubernetes pod running with specific UID

I am doing some security research on Kubernetes and I found something still mysterious to me, concerning capabilities. Example of simple pod: apiVersion: v1 kind: Pod metadata: name: my-pod-httpd ...
cactuschibre's user avatar
1 vote
1 answer
246 views

How to keep data in eBPF maps secure

I have read that there are some capabilities that are broken out of CAP_SYS_ADMIN specifically CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON etc. I also read that data structures called maps are used to store ...
Flint_security's user avatar
2 votes
1 answer
279 views

Container escape - CVE-2022-0492 - hybrid cgroups?

I saw the recent CVE-2022-0492 that can enable container escape, and I have a decent understanding of cgroups and container capabilities, but not very familiar with how hybrid cgroup v1/v2 works, nor ...
4oo4's user avatar
  • 125
2 votes
1 answer
136 views

What additional protection does seccomp provide when compared to capabilites?

From this answer I understand that seccomp-bpf filters the list of syscalls a process can call. Similarly, the capabilites mechanism will cause a syscall to fail if the caller does not have the ...
inorik's user avatar
  • 197
4 votes
1 answer
549 views

Privilege escalation writing /etc/passwd but without SUID permission on su

This is not an exercise, there might be no solution. We are producing a Docker image (based on CentOS) which is designed to be executed by a non-root user. However, this user has write access to /etc/...
rt15's user avatar
  • 41
-1 votes
1 answer
580 views

Are IPv4 more intuitively hard to track than IPv6?

I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin's IP address is IPv6, rather than if its IPv4: For example, since I configured ...
user avatar
2 votes
0 answers
439 views

attach with gdb after dropping privileges

Under Ubuntu 16.04 LTS, I cannot seem to debug a once-privileged process for love or money as an unprivileged user. The file is setgid (mode 2755). It forks, and the child: releases its ...
James K. Lowden's user avatar
6 votes
1 answer
715 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
Cera's user avatar
  • 111
13 votes
2 answers
4k views

Difference between linux capabities and seccomp

I know seccomp (secure computing) is a way to restrict a process from making particular system calls. While linux capabilities provides a way to give privileges to specific user or process. So if I ...
mchawre's user avatar
  • 233
4 votes
1 answer
858 views

Why do capability-based security systems protect against the confused deputy problem?

According to Wikipedia (https://en.wikipedia.org/wiki/Confused_deputy_problem): In information security, the confused deputy problem is often cited as an example of why capability-based security ...
dippynark's user avatar
  • 143
19 votes
2 answers
10k views

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...
JackDaniels's user avatar
1 vote
1 answer
966 views

Use of S/MIME capabilities attribute

If you examine an S/MIME-signed file with $ openssl cms -in file.sgn -noout -cmsout -print you see that S/MIME capabilities are also included in the signature: ... object: S/MIME Capabilities (1.2....
user1511417's user avatar
4 votes
1 answer
10k views

Security implications of using SETCAP CAP_NET_RAW

In order to get around the 'problem' of applications requiring root privileges to run, I'm using: sudo setcap CAP_NET_ADMIN+ep "$(readlink -f /usr/sbin/app)" sudo setcap CAP_NET_RAW+ep "$(readlink -f ...
Crizly's user avatar
  • 2,617
2 votes
2 answers
717 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
rover01's user avatar
  • 21
4 votes
1 answer
678 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a process/...
Whome's user avatar
  • 1,241
2 votes
1 answer
930 views

What is the difference between claims and capabilities in access control?

I've read about the differences between capabilities and access control lists, but to me capabilities seem similar to claims. Can anyone explain the difference, if there is one?
Sámal Rasmussen's user avatar
3 votes
2 answers
3k views

Do `sudo` and `su` belong to capability-based security?

In Linux, do sudo and su belong to Capability-based security ? For example, when editing a system file, we usually need sudo or su to temporarily switch to user root. Does this example belong to ...
Tim's user avatar
  • 637
5 votes
1 answer
852 views

Capability-based security vs protection rings: in what sense are they diametrically opposite?

From https://en.wikipedia.org/wiki/Capability-based_security Capability-based security is to be contrasted with an approach that uses hierarchical protection domains. From https://en.wikipedia.org/...
Tim's user avatar
  • 637
6 votes
2 answers
1k views

Combining capability-based access control with SAML

I have been looking into various research on identity, PKI and access control trying to boil it down to a simplified methodology for IAM (Identity & Access Management). One thing which pops up in ...
Rolf Rander's user avatar
6 votes
2 answers
3k views

What are the practical differences between SELinux targeted mode and a capability based OS?

I recently asked a question about the differences between capabilities and mandatory access controls. Among the answers I got the point was made that systems like SE Linux in targeted mode are not a ...
Sonny Ordell's user avatar
  • 3,516
9 votes
5 answers
3k views

What is the practical difference between MAC and Capabilities

Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user. Is there any ...
Sonny Ordell's user avatar
  • 3,516