How come `setcap all=eip` has fewer capabilities than `setcap cap_sys_admin=eip`?
1
vote
0
answers
94
views
This question is a follow up to this question:
https://unix.stackexchange.com/questions/792580/can-a-non-zero-not-0-not-root-user-run-a-process-with-capabilities-pid-e
And it is likely related to my other question here: https://unix.stackexchange.com/questions/792601/do-child-processes-inherit-capabilities-of-parent-processes
IN the comments of the previous question, I thought maybe
setcap all=eip
gave a process all capabilities, and that it would have more capabilities than cap_sys_admin
. But I think my comment is wrong. Here's what I tried
First, I want to make a copy of the bash binary and give it the setcap all=eip
, then run the newly created bash binary to see if I have capabilities similar to those of a root user.
bob@bob:~$ getpcaps $$ # confirm current bash has no capabilities
7210: =
bob@bob:~$ sudo setcap all=eip /usr/local/bin/testing_bash
bob@bob:~$ getcap /usr/local/bin/testing_bash
/usr/local/bin/testing_bash =eip
bob@bob:~$ /usr/local/bin/testing_bash
bob@bob:~$ getpcaps $$
7329: =ep
So at first, it seems that setcap all=eip
can allow bob to run testing_bash
as if he were root.
But upon more investigation, it seems that setcap all=eip
has **fewer capabilities** than setcap cap_sys_admin=eip
. Here's a followup experiment I tried that led me to this observation:
# trying the all=eip
bob@bob:~$ mkdir dir1
bob@bob:~$ sudo cp /bin/mount /usr/local/bin/testing_mount
bob@bob:~$ sudo setcap all=eip /usr/local/bin/testing_mount
bob@bob:~$ getcap /usr/local/bin/testing_mount # confirmed all capabilities exists
/usr/local/bin/testing_mount =eip
bob@bob:~$ /usr/local/bin/testing_mount -t tmpfs temp dir1
testing_mount: drop permissions failed.
# remove the testing_mount and try with cap_sys_admin=eip
bob@bob:~$ sudo rm -f /usr/local/bin/testing_mount
bob@bob:~$ sudo cp /bin/mount /usr/local/bin/testing_mount
bob@bob:~$ sudo setcap cap_sys_admin=eip /usr/local/bin/testing_mount
bob@bob:~$ getcap /usr/local/bin/testing_mount # confirmed cap_sys_admin exists
/usr/local/bin/testing_mount cap_sys_admin=eip
bob@bob:~$ /usr/local/bin/testing_mount -t tmpfs temp dir1
bob@bob:~$ echo 'test' > dir1/test.txt
bob@bob:~$ cat dir1/test.txt
test
bob@bob:~$ sudo umount -l dir1
bob@bob:~$ ls dir1
So it seems the cap_sys_admin
has more capabilities than all
? I am confused by this. Can anyone help clear up my confusion?
Asked by learningtech
(631 rep)
Mar 17, 2025, 02:09 PM
Last activity: Mar 17, 2025, 02:35 PM
Last activity: Mar 17, 2025, 02:35 PM