Now living in a world where security is so important,
we probably can avoid using our special permissions in some instances.
Using our special permissions, especially things like the set‑user‑id bit,
we are then allowing that program to run as root.
If there was a vulnerability in that program,
what we might find is that people get access to more than they
should by making use of that vulnerability.
With capabilities, we can go through and assign specific activity to the program,
limiting its access to everything else.
We can go through and take a look at the man page,
either locally on our system or through the internet,
and man 7 capabilities will show you what is available through capabilities.
We can also use the cap show command to print out
the capabilities on our system.
The getcap can go through and read the capabilities from an executable,
and we can use setcap to set capabilities.
Now the very best way to learn about this is to go out to our command line and
see in recent years how the ping program has changed from being a set‑user‑id
program through to being a capability‑based program.
So here we are, and if we go out and test our ping command as a standard user,
and let's just try pinging 1.1,
1.1 will take us through to our Cloudflare server,
and we can see there that we're getting our response coming back,
so everything is working as it should do.
However, to be able to access ICMP packets,
we need access to the networking raw, which isn't typically allowed.
When I go through and use ls ‑l and take a look at
the program that we've been using, usr/bin/ping,
when I look at this, although it is highlighted in red,
we can look at the permissions, and if we look carefully,
we're not noticing any set‑user‑id bit configured there.
So we are not making use of the traditional way to
gain access to the ping command,
and this is common on a lot of more recent Linux distributions,
and we're making use of capabilities.
We can go through and take a look at what capabilities
are set using the getcap command.
If we look at that for our ping program,
we can see we've got two capabilities, the network admin and the network raw,
and they're both permitted.
So anybody executing this will have access to these capabilities,
and it's these that are gaining access to the networking commands.
Now with this, that it's a restricted set of commands,
and we're not then giving full capabilities as the root user.
If we want to look at all of the capabilities that are available on this system,
we can go through and use the capsh ‑‑print command.
Now there are no current capabilities, users don't normally have capabilities,
but we can see there are a lot of capabilities available.
One of them we can see is the capability _dac,
discretionary access control list, override.
Now root would normally have that.
This is then the ability where the root user can pretty much
access any file within the file system because we have that
capability as the root user.
But this then lists the capabilities that are available to us,
and we can see then the capabilities are set on our
ping command so we're able to use it.
If I clear the screen, and then just taking a look at using the setcap command,
so sudo and setcap,
if I just set it to an empty string so we have no
capability set for then our ping program,
of course, if I go now and try and ping 1.1,
we're going to see then that I no longer have the ability to do that.
I don't have the ability to open up that socket.
If we go through and set our capabilities back,
so if I just up arrow key and then go through,
and to be honest, we should be able to get by with just the networking raw,
so we can go through and set our capability _net_raw,
and we want that to be permitted, now as I go back and try and ping the device,
we're able then to go through and use the ping command,
and let's do a Ctrl+C on that.
So the idea then of reducing the administrative capability through
capabilities then just allows us to access exactly what we need and not have full reign to the whole system.