Difference between pages "Capabilities" and "Organization:Squire Labs"

(Difference between pages)
(Requirements: tar vs caps)
 
 
Line 1: Line 1:
Linux ''capabilities'' provide a mechanism of giving processes some of root's privileges. This aims to improve security via limiting the privileges processes have to have (compared to processes having all root's privileges) and therefore the privileges that could be exploited.
+
{{Organization
 +
|Logo=Image.jpg
 +
|Homepage=http://www.squire-labs.com
 +
|Summary=Help companies invest in their staff through online training. We built squire.io as a platform to provide generic tools,but also provide specialised software and services for those who require them.
 +
|Funtoo Services=No service directly, but our hosting infrastructure runs on funtoo
 +
|Geoloc=-33.9248685, 18.4240553
 +
|Location name=Cape Town
 +
}}
  
== Requirements ==
+
{{OrganizationFooter}}
The capabilities are fully supported by Linux since 2.6.24.
+
 
+
For capability bits to be assigned to files (as a replacement for setuid root), the underlying filesystem needs to have xattr support with security namespace.
+
 
+
For capabilities to be stored inside .tar archives, ''--xattrs'' option needs to be used. For capabilities to be '''extracted''' from .tar archives, ''--xattrs --xattrs-include=security.capability'' needs to be passed to the extraction command.
+
 
+
== Rationale ==
+
Capabilities are a preventive form of security. If a program is vulnerable, then the attacker may be able to use the vulnerability to use program's root privileges for malicious reasons. By limiting the privileges, capabilities reduce the risks associated with vulnerability.
+
 
+
For example, the ''ping'' program needs to open raw network socket which is a privileged operation. In order to allow non-root users to use it, setuid bit is set on the executable. This way, when run by an unprivileged user ''ping'' automatically gains root privileges and can open the socket. However, this means that if a security vulnerability is found inside ''ping'', it can be exploited by user to perform malicious actions with root privileges.
+
 
+
The alternative is to mark ''ping'' with capability ''CAP_NET_RAW+pe'' (instead of setuid root). In this case, ''ping'' is given the capability to open raw network sockets without other root privileges. If a security vulnerability is exploited, it can only be used to open raw network sockets but can't e.g. access files belonging to other users.
+

Revision as of 17:59, January 27, 2015

Squire Labs

Funtoo-Friendly Organization

Help companies invest in their staff through online training. We built squire.io as a platform to provide generic tools,but also provide specialised software and services for those who require them.

Visit the Squire Labs Web site.

Funtoo-Related Services

No service directly, but our hosting infrastructure runs on funtoo

Other Services

This organization only offers Funtoo-related services.


Tip

Are you part of a Funtoo-friendly organization? Community or commercial -- register it on the Funtoo Linux Wiki to let our user community know about it!


Loading map...
Cape Town