Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
  • su user_name program starts some program with other uid;
  • chroot path program starts some program with other /;
  • ( ulimit -v 80000; program) limits program memory...

How to limit program's capabilities(7)?

I only see setcap(8) tool that sets file cabapilities; how to do something like this:

root# start_program_with_capabilities_dropped_except_of CAP_NET_RAW,CAP_NET_ADMIN program

How to start a program with my set of capabilities without using file capabilities?

For example I am root and want to start ping:

  • As non-root
  • With PR_SET_NO_NEW_PRIVS flag (so all setuid-bit and file capabilities go away)
  • With only CAP_NET_RAW active and everything else deniced
  • With ping being aware that it is in unprivileged mode (ping: cannot flood; minimal interval, allowed for user, is 200ms)
share|improve this question

2 Answers 2

System rights and MAC (Mandatory Access Control) sub-layers exist for these purposes. to constrain the capabilities as your link has defined them, use a user account that has exactly the rights you desire. combine with SU and file permissions to ensure that your app runs only for that user.

For MACs, common examples include Selinux (NSA/Redhat) and AppArmor(Novell). They limit the resources that an application can access. remember in linux, everything is a file, so by locking out the needed files, you can constrain an apps capabilities. MAC systems use a white-list to allow apps to access only specified resources, and as such, by default all access is denied. I use an app armor for firefox for instance that restricts it to its app/cache area in my $HOME and stuff like my downloads folder.

share|improve this answer
    
It is big and complicated. I'm looking for simple tool just for one task: start other processes with uid/gid/euid/capabilities/root/whatever_can_be_needed_for_security overridden (without config files, just command line). –  Vi. Jan 31 '13 at 12:50
    
I've not seen evidence that somthing like that exists for modern linux systems, but if I see anything, I'll post back. otherwise, work with what you have. –  Frank Thomas Jan 31 '13 at 12:51
    
I found netsh, hovewer it is inconvenient and I can't get it to work... –  Vi. Jan 31 '13 at 13:05
up vote 1 down vote accepted

The capsh program seems to be designed for it.

Additionally I've implemented this as a mode in my dived program.

I still don't know how to explicitly specify caps in spite of the filesystem capabilities.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.