Senior LevelLinux Commands & SysAdmin
How do Linux Capabilities (CAP_SYS_ADMIN, CAP_NET_ADMIN) replace binary root access?
❓ Interview Prompt: Explain Linux Capabilities, splitting root privilege, CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, setcap, and getcap commands.
Traditionally, if a process needed to perform a privileged task (like binding to port 80), it had to run with full root privileges (UID 0).
Linux Capabilities:
Linux splits root privileges into distinct Capabilities:
•
CAP_NET_BIND_SERVICE: Bind sockets to ports < 1024.
•
CAP_NET_ADMIN: Configure network interfaces and firewall rules.
•
CAP_SYS_ADMIN: Powerful administration operations.
Assign capabilities to binaries via 'setcap', allowing unprivileged users to execute specific privileged tasks safely!
Code Implementation Example
bash
# Grant Node.js binary permission to bind port 80 without running as root
sudo setcap 'cap_net_bind_service=+ep' /usr/bin/node
# Inspect capabilities assigned to executable binary
getcap /usr/bin/node💡Assigning CAP_NET_BIND_SERVICE capability to Node.js binary via setcap.
🎯 Interview Key Takeaway
Use Linux Capabilities (setcap) to grant granular privileges to binaries without running applications as full root.
#Capabilities#setcap#Security#Least Privilege#Senior
Back to all Linux Commands & SysAdmin Questions→