capabilities(7) - Linux man page

Name

capabilities - overview of Linux capabilities

Description

For the purpose of performing permission checks, traditional UNIX implementations distinguish two categories of processes: privileged processes (whose effective user ID is 0, referred to as superuser or root), and unprivileged processes (whose effective UID is nonzero). Privileged processes bypass all kernel permission checks, while unprivileged processes are subject to full permission checking based on the process's credentials (usually: effective UID, effective GID, and supplementary group list).

Starting with kernel 2.2, Linux divides the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled and disabled. Capabilities are a per-thread attribute.

Capabilities list

The following list shows the capabilities implemented on Linux, and the operations or behaviors that each capability permits:

CAP_AUDIT_CONTROL (since Linux 2.6.11)

Enable and disable kernel auditing; change auditing filter rules; retrieve auditing status and filtering rules.

CAP_AUDIT_WRITE (since Linux 2.6.11)

Write records to kernel auditing log.

CAP_BLOCK_SUSPEND (since Linux 3.5)

Employ features that can block system suspend (epoll(7) EPOLLWAKEUP, /proc/sys/wake_lock).

CAP_CHOWN

Make arbitrary changes to file UIDs and GIDs (see chown(2)).

CAP_DAC_OVERRIDE

Bypass file read, write, and execute permission checks. (DAC is an abbreviation of "discretionary access control".)

CAP_DAC_READ_SEARCH

Bypass file read permission checks and directory read and execute permission checks.

CAP_FOWNER

*

Bypass permission checks on operations that normally require the file system UID of the process to match the UID of the file (e.g., chmod(2), utime(2)), excluding those operations covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH;

*

set extended file attributes (see chattr(1)) on arbitrary files;

*

set Access Control Lists (ACLs) on arbitrary files;

*

ignore directory sticky bit on file deletion;

*

specify O_NOATIME for arbitrary files in open(2) and fcntl(2).

CAP_FSETID

Don't clear set-user-ID and set-group-ID permission bits when a file is modified; set the set-group-ID bit for a file whose GID does not match the file system or any of the supplementary GIDs of the calling process.

CAP_IPC_LOCK

Lock memory (mlock(2), mlockall(2), mmap(2), shmctl(2)).

CAP_IPC_OWNER

Bypass permission checks for operations on System V IPC objects.

CAP_KILL

Bypass permission checks for sending signals (see kill(2)). This includes use of the ioctl(2) KDSIGACCEPT operation.

CAP_LEASE (since Linux 2.4)

Establish leases on arbitrary files (see fcntl(2)).

CAP_LINUX_IMMUTABLE

Set the FS_APPEND_FL and FS_IMMUTABLE_FL i-node flags (see chattr(1)).

CAP_MAC_ADMIN (since Linux 2.6.25)

Override Mandatory Access Control (MAC). Implemented for the Smack Linux Security Module (LSM).

CAP_MAC_OVERRIDE (since Linux 2.6.25)

Allow MAC configuration or state changes. Implemented for the Smack LSM.

CAP_MKNOD (since Linux 2.4)

Create special files using mknod(2).

CAP_NET_ADMIN

Perform various network-related operations:

*

interface configuration;

*

administration of IP firewall, masquerading, and accounting

*

modify routing tables;

*

bind to any address for transparent proxying;

*

set type-of-service (TOS)

*

clear driver statistics;

*

set promiscuous mode;

*

enabling multicasting;

*

use setsockopt(2) to set the following socket options: SO_DEBUG, SO_MARK, SO_PRIORITY (for a priority outside the range 0 to 6), SO_RCVBUFFORCE, and SO_SNDBUFFORCE.

CAP_NET_BIND_SERVICE

Bind a socket to Internet domain privileged ports (port numbers less than 1024).

CAP_NET_BROADCAST

(Unused) Make socket broadcasts, and listen to multicasts.

CAP_NET_RAW

*

use RAW and PACKET sockets;

*

bind to any address for transparent proxying.

CAP_SETGID

Make arbitrary manipulations of process GIDs and supplementary GID list; forge GID when passing socket credentials via UNIX domain sockets.

CAP_SETFCAP (since Linux 2.6.24)

Set file capabilities.

CAP_SETPCAP

If file capabilities are not supported: grant or remove any capability in the caller's permitted capability set to or from any other process. (This property of CAP_SETPCAP is not available when the kernel is configured to support file capabilities, since CAP_SETPCAP has entirely different semantics for such kernels.)

If file capabilities are supported: add any capability from the calling thread's bounding set to its inheritable set; drop capabilities from the bounding set (via prctl(2) PR_CAPBSET_DROP); make changes to the securebits flags.

CAP_SETUID

Make arbitrary manipulations of process UIDs (setuid(2), setreuid(2), setresuid(2), setfsuid(2)); make forged UID when passing socket credentials via UNIX domain sockets.

CAP_SYS_ADMIN

*

Perform a range of system administration operations including: quotactl(2), mount(2), umount(2), swapon(2), swapoff(2), sethostname(2), and setdomainname(2);

*

perform privileged syslog(2) operations (since Linux 2.6.37, CAP_SYSLOG should be used to permit such operations);

*

perform VM86_REQUEST_IRQ vm86(2) command;

*

perform IPC_SET and IPC_RMID operations on arbitrary System V IPC objects;

*

perform operations on trusted and security Extended Attributes (see attr(5));

*

use lookup_dcookie(2);

*

use ioprio_set(2) to assign IOPRIO_CLASS_RT and (before Linux 2.6.25) IOPRIO_CLASS_IDLE I/O scheduling classes;

*

forge UID when passing socket credentials;

*

exceed /proc/sys/fs/file-max, the system-wide limit on the number of open files, in system calls that open files (e.g., accept(2), execve(2), open(2), pipe(2));

*

employ CLONE_* flags that create new namespaces with clone(2) and unshare(2);

*

call perf_event_open(2);

*

access privileged perf event information;

*

call setns(2);

*

call fanotify_init(2);

*

perform KEYCTL_CHOWN and KEYCTL_SETPERM keyctl(2) operations;

*

perform madvise(2) MADV_HWPOISON operation;

*

employ the TIOCSTI ioctl(2) to insert characters into the input queue of a terminal other than the caller's controlling terminal.

*

employ the obsolete nfsservctl(2) system call;

*

employ the obsolete bdflush(2) system call;

*

perform various privileged block-device ioctl(2) operations;

*

perform various privileged file-system ioctl(2) operations;

*

perform administrative operations on many device drivers.

CAP_SYS_BOOT

Use reboot(2) and kexec_load(2).

CAP_SYS_CHROOT

Use chroot(2).

CAP_SYS_MODULE

Load and unload kernel modules (see init_module(2) and