1

I am looking for a software - preferably packaged - which allows me to execute a program with fewer capabilities than a full superuser context would grant. Yes, this is mainly about dropping capabilities.

Capabilities are a way to hand out superuser rights "in slices". And while capsh fits the bill, it does not provide a way to declare a policy similar to what /etc/sudoers allows.

So: is there a tool which can drop capabilities and is configurable via files?

Improve this question
2
  • What do you mean by "configurable via files"? Sooner or later, everything is in a file. I would create a new user with just the rights you want and then use runuser -l username -c 'command' – Thomas Weller Jun 12 '20 at 16:40
  • @ThomasWeller could you explain how exactly I can configure that new user to have a limited set of capabilities as opposed to the - somewhat binary - superuser vs. unprivileged scheme? Thanks. I'm simply not aware of a method like this and was hoping that capabilities would be a nice way of handing out particular privileges in small doses ... smaller doses than allowing user X to run certain commands as full superuser. Configurable via files should be clear from drawing the line to sudoers, no? – 0xC0000022L Jun 12 '20 at 19:56
1

firejail might be the tool that fits your need. It was initially written for Firefox but now handle other software.

See https://firejail.wordpress.com/

It says:

Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.

You can find examples of their default profile, to restrict things per application at https://github.com/netblue30/firejail/tree/master/etc/profile-a-l and https://github.com/netblue30/firejail/tree/master/etc/profile-m-z

The documentation explains how to write your own custom profiles.

Improve this answer
1
  • Thanks. I'm aware of firejail, in fact I am using it already for GUI stuff, but I hadn't considered it for this particular purpose. I'll see whether this nudges me in the right direction. Until then, have an upvote. – 0xC0000022L Jun 13 '20 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.