> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/identification-authentication-and-authorization/linux-security-mechanisms/capabilities.md).

# Capabilities

Protection mechanism introduced in Kernel 2.2.

Allow to divide the traditional super-user privileges into distinct units.

* That can be independently enabled and disabled.

Capabilities are a per-thread attribute.

* Propagated through **forks**.
* Changed explicitly by **execs**.

## List of capabilities

Examples (small sample …)

* CAP\_CHOWN
  * Make arbitrary changes to file UIDs and GIDs.
* CAP\_DAC\_OVERRIDE / CAP\_DAC\_READ\_SEARCH
  * Bypass file permission/directory transversal checks.
* CAP\_KILL
  * Bypass permission checks for sending signals.
* CAP\_NET\_ADMIN
  * Perform various network-related operations.
* CAP\_SYS\_ADMIN
  * Overloaded general-purpose administration capability.

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FQ7aqfdGcj1hD3LrVuql6%2Fimage.png?alt=media&amp;token=da7d1181-61e3-4b05-966f-07b55d4f01f1" alt=""><figcaption></figcaption></figure>

## Capability management

Per-thread capabilities.

* They define the privileges of the thread.
* Divided into **sets**.

Sets.

* Effective
* Inheritable
* Permitted
* Bounding
* Ambient

## Thread capability sets

### Effective

Set of capabilities used by the kernel to perform permission checks for the thread.

That is: these are the effective capabilities being used.

### Inheritable

Set of capabilities preserved across an **exec**.

* Remain inheritable for any program.

Are added to the permitted set when executing a program that has the corresponding bits set in the file inheritable set.

### Permitted

Limiting superset.

* For the effective capabilities that the thread may assume.
* For the capabilities that may be added to the inheritable set.
  * Except for threads w/ CAP\_SETPCAP in their effective set.

Once dropped, it can never be reacquired.

* Except upon executing a file with special capabilities.

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FVqDvbbK9K1wB5y45EJy3%2Fimage.png?alt=media&amp;token=5d267c40-8e60-4559-8938-8bbb6e9ee2be" alt=""><figcaption></figcaption></figure>

### Bounding

Set used to limit the capabilities that are gained during an exec.

* From a file with capabilities set.

Was previously a system-wide attribute.

* Now is a per-thread attribute.

## Ambient

Set of capabilities that are preserved across an exec of an unprivileged program.

* No set-UID or set-GID.
* No capabilities set.

Executing a privileged program will clear the ambient set.

Ambient capabilities must be both permitted and inheritable.

* One cannot preserve something one cannot have.
* One cannot preserve something one cannot inherit.
* Automatically lowered if either of the corresponding permitted or inheritable capabilities is lowered.

Ambient capabilities are added to the permitted set and assigned to the effective set upon an **exec**.