Difference between pages "Package:Macchanger" and "Capabilities"

(Difference between pages)
m (random ending wasn't working, removed ill try to get it working again one day)
 
(describe rationale and requirements for capabilities)
 
Line 1: Line 1:
{{Ebuild
+
Linux ''capabilities'' provide a mechanism of giving processes some of root's privileges. This aims to improve security via limiting the privileges processes have to have (compared to processes having all root's privileges) and therefore the privileges that could be exploited.
|Summary=Utility for viewing/manipulating the MAC address of network interfaces
+
|CatPkg=net-analyzer/macchanger
+
|Homepage=https://github.com/alobbs/macchanger
+
}}
+
  
 +
== Requirements ==
 +
The capabilities are fully supported by Linux since 2.6.24.
  
{{console|body=###i## emerge net-analyzer/macchanger}}
+
For capability bits to be assigned to files (as a replacement for setuid root), the underlying filesystem needs to have xattr support with security namespace.
  
=== Usage ===
+
== Rationale ==
{{note|to change an address you must completely disconnect from all networks on the interface}}
+
Capabilities are a preventive form of security. If a program is vulnerable, then the attacker may be able to use the vulnerability to use program's root privileges for malicious reasons. By limiting the privileges, capabilities reduce the risks associated with vulnerability.
==== Show Vendor Codes ====
+
{{console|body=###i## macchanger -l}}
+
  
==== Generate a Random Address ====
+
For example, the ''ping'' program needs to open raw network socket which is a privileged operation. In order to allow non-root users to use it, setuid bit is set on the executable. This way, when run by an unprivileged user ''ping'' automatically gains root privileges and can open the socket. However, this means that if a security vulnerability is found inside ''ping'', it can be exploited by user to perform malicious actions with root privileges.
{{console|body=###i## macchanger -r wlan0}}
+
  
==== Pretend To Be A Burned In Address ====
+
The alternative is to mark ''ping'' with capability ''CAP_NET_RAW+pe'' (instead of setuid root). In this case, ''ping'' is given the capability to open raw network sockets without other root privileges. If a security vulnerability is exploited, it can only be used to open raw network sockets but can't e.g. access files belonging to other users.
{{console|body=###i## macchanger -rb wlan0}}
+
 
+
==== Manually Assign an Address ====
+
{{console|body=###i## macchanger -m 11:22:33:44:55:66 wlan0}}
+
 
+
==== Revert All Changes ====
+
{{console|body=###i## macchanger -p wlan0}}
+
{{EbuildFooter}}
+

Revision as of 10:42, January 17, 2015

Linux capabilities provide a mechanism of giving processes some of root's privileges. This aims to improve security via limiting the privileges processes have to have (compared to processes having all root's privileges) and therefore the privileges that could be exploited.

Requirements

The capabilities are fully supported by Linux since 2.6.24.

For capability bits to be assigned to files (as a replacement for setuid root), the underlying filesystem needs to have xattr support with security namespace.

Rationale

Capabilities are a preventive form of security. If a program is vulnerable, then the attacker may be able to use the vulnerability to use program's root privileges for malicious reasons. By limiting the privileges, capabilities reduce the risks associated with vulnerability.

For example, the ping program needs to open raw network socket which is a privileged operation. In order to allow non-root users to use it, setuid bit is set on the executable. This way, when run by an unprivileged user ping automatically gains root privileges and can open the socket. However, this means that if a security vulnerability is found inside ping, it can be exploited by user to perform malicious actions with root privileges.

The alternative is to mark ping with capability CAP_NET_RAW+pe (instead of setuid root). In this case, ping is given the capability to open raw network sockets without other root privileges. If a security vulnerability is exploited, it can only be used to open raw network sockets but can't e.g. access files belonging to other users.