Do child processes inherit capabilities of parent processes?
5
votes
1
answer
100
views
I am having a difficult time understanding how capabilities are inherited. It is possible there is no such thing as "capability inheritance" and that I have completely misunderstood this documentation:
https://man7.org/linux/man-pages/man7/capabilities.7.html
So I may need help re-orienting my entire understanding of what linux capabilities are!
In terms of how I tried to understand capability inheritance, here is the experiment I ran:
bob@bob:~$ getcap /bin/bash # show no capabilities
bob@bob:~$ getpcaps $$ # shows no capabilities
2076: =
bob@bob:~$ sudo cp /bin/bash /usr/local/bin/testing_bash # let's make a copy of bash and give it all capabilities
bob@bob:~$ sudo setcap all=eip /usr/local/bin/testing_bash # giving all capabilities
bob@bob:~$ getcap /usr/local/bin/testing_bash # shows all capabilities
/usr/local/bin/testing_bash =eip
bob@bob:~$ /usr/local/bin/testing_bash # run bash with same capabilities as root
bob@bob:~$ getpcaps $$ # confirmed I have same capabilities as root
2092: =ep
bob@bob:~$ mkdir hello
bob@bob:~$ mount -t tmpfs test hello
mount: /home/bob/helloworld: must be superuser to use mount.
Basically I copied the bash
command to testing_bash
and gave it all capabilities so that I can run it as if i were root user. I run the testing_bash
and confirmed that I do have all the escalated capabilities. But when I run the mount
command later, it did not inherit my escalated capabilities, and instead I get a permission error.
I tried reading this link here but I fail to comprehend:
https://man7.org/linux/man-pages/man7/capabilities.7.html
Specifically the line on Inheritable
. I thought if I add the letter i
to eip
in the setcap all=eip
, that means all child processes will inherit the capabilities of /usr/local/bin/testing_bash
?
I repeated a similar experiment with the User Namespace and still encountered the same capabilities error:
bob@bob:~$ unshare -U /usr/local/bin/testing_bash
nobody@bob:~$ getpcaps $$
2123: =ep
nobody@bob:~$ unshare -m /bin/bash
unshare: unshare failed: Operation not permitted
In other words, I start a new namespace with the testing_bash
, confirmed I have all capabilities, but running the unshare
command gives a capabilities/permission error.
So my question is, **have I mis-understood how capability inheritance works?**
-----
I am very new to learning about linux in general and linux capabilities. It's possible my question above is related to these two other questions I asked recently:
https://unix.stackexchange.com/questions/792580/can-a-non-zero-not-0-not-root-user-run-a-process-with-capabilities-pid-e
https://unix.stackexchange.com/questions/792603/how-come-setcap-all-eip-has-fewer-capabilities-than-setcap-cap-sys-admin-eip
Asked by learningtech
(631 rep)
Mar 17, 2025, 01:45 PM
Last activity: Jun 8, 2025, 08:42 PM
Last activity: Jun 8, 2025, 08:42 PM