My co-worker, Serge Hallyn was in town the other day, so he popped by to tell us about file capabilities. I think that file capabilities are the missing link for making capabilities useful and I’m tremendously excited that they will soon be generally available. File capabilities are a feature that allow a system administrator to add specific capabilities to an executable (stored in extended attributes, set using setfcaps or setcap). This in turn means that if the necessary capabilities exist then executables no longer have to be setuid root. Rather than having daemons start as root and drop privileges, if the proper file capabilities are set, they can just start as their regular user. The canonical example is ping. It is currently setuid root but it only needs the cap_net_raw capability. Using file capabilities, you can remove the setuid bit, add the cap_net_raw bit and you decrease the chance that ping can be used to subvert your system. Chris Friedhoff has an excellent page[1] which describes how to use file capabilities in more interesting ways, for example on X and Samba.

Here are the notes that I took from Serge’s discussion:

3 sets of capabilities
I – inheritable (have after exec)
P – permitted set
E – effective set (right now)

capset()
can remove from inherited set but can only put them in if you have CAP_SETPCAP
can remove from effective set and can put them back in if in permitted set
can remove from permitted set but can’t put them back in

pI’ = pI
pP’ = union(intersection(pI,fI), fP)
pE’ = fE ? pP’ : empty set

The capabilities in the file’s permitted set (fP) are known as the ‘forced set’ because the process will wind up with the capability regardless.
64 bit capability set now in -mm. This will make it easier to add new capabilities to hopefully further reduce the need for setuid programs.

Capabilities stack with SELinux and AppArmor implements capabilities directly in their LSM (hopefully they will pick up file capabilities), so you are not faced with an either/or decision about using capabilities. Capabilities allow you to grant additional privilege where LSMs can only further restrict privilege.

So if you want to experiment with it, grab the latest 2.6.24 release candidate. If you are a Fedora user, you can enable the rawhide repository and install the rawhide kernel. You will still have to install your chosen user space package manually, either from kernel.org[2] or from KaiGai Kohei who has updated libcap[3] to add setfscaps. He is now pointing off to a Google site which is inaccessible to me but his old packages still seem to work.

If you are interested in this topic, I highly recommend Serge’s excellent article on developerWorks: POSIX file capabilities: Parceling the power of root[4]

UPDATE: libcap2 supports the 64 bit capabilities that are now in the -mm tree. For the vanilla 2.6.24-* tree, use libcap1 from http://www.kernel.org/pub/linux/libs/security/linux-privs/libcap1/

UPDATE 2: libcap 2.03 supports both 32 and 64 bit capabilities.

[1] http://friedhoff.org/fscaps.html
[2] http://ftp.kernel.org/pub/linux/libs/security/linux-privs/libcap2/
[3] http://www.kaigai.gr.jp/
[4] http://www.ibm.com/developerworks/linux/library/l-posixcap.html