Sample Header Ad - 728x90

Do child processes inherit capabilities of parent processes?

5 votes
1 answer
100 views
I am having a difficult time understanding how capabilities are inherited. It is possible there is no such thing as "capability inheritance" and that I have completely misunderstood this documentation: https://man7.org/linux/man-pages/man7/capabilities.7.html So I may need help re-orienting my entire understanding of what linux capabilities are! In terms of how I tried to understand capability inheritance, here is the experiment I ran:
bob@bob:~$ getcap /bin/bash # show no capabilities
bob@bob:~$ getpcaps $$ # shows no capabilities
2076: =
bob@bob:~$ sudo cp /bin/bash /usr/local/bin/testing_bash # let's make a copy of bash and give it all capabilities
bob@bob:~$ sudo setcap all=eip /usr/local/bin/testing_bash # giving all capabilities
bob@bob:~$ getcap /usr/local/bin/testing_bash # shows all capabilities
/usr/local/bin/testing_bash =eip
bob@bob:~$ /usr/local/bin/testing_bash # run bash with same capabilities as root
bob@bob:~$ getpcaps $$ # confirmed I have same capabilities as root
2092: =ep
bob@bob:~$ mkdir hello
bob@bob:~$ mount -t tmpfs test hello
mount: /home/bob/helloworld: must be superuser to use mount.
Basically I copied the bash command to testing_bash and gave it all capabilities so that I can run it as if i were root user. I run the testing_bash and confirmed that I do have all the escalated capabilities. But when I run the mount command later, it did not inherit my escalated capabilities, and instead I get a permission error. I tried reading this link here but I fail to comprehend: https://man7.org/linux/man-pages/man7/capabilities.7.html Specifically the line on Inheritable. I thought if I add the letter i to eip in the setcap all=eip, that means all child processes will inherit the capabilities of /usr/local/bin/testing_bash? I repeated a similar experiment with the User Namespace and still encountered the same capabilities error:
bob@bob:~$ unshare -U /usr/local/bin/testing_bash
nobody@bob:~$ getpcaps $$
2123: =ep
nobody@bob:~$ unshare -m /bin/bash
unshare: unshare failed: Operation not permitted
In other words, I start a new namespace with the testing_bash, confirmed I have all capabilities, but running the unshare command gives a capabilities/permission error. So my question is, **have I mis-understood how capability inheritance works?** ----- I am very new to learning about linux in general and linux capabilities. It's possible my question above is related to these two other questions I asked recently: https://unix.stackexchange.com/questions/792580/can-a-non-zero-not-0-not-root-user-run-a-process-with-capabilities-pid-e https://unix.stackexchange.com/questions/792603/how-come-setcap-all-eip-has-fewer-capabilities-than-setcap-cap-sys-admin-eip
Asked by learningtech (631 rep)
Mar 17, 2025, 01:45 PM
Last activity: Jun 8, 2025, 08:42 PM