Sample Header Ad - 728x90

How come `setcap all=eip` has fewer capabilities than `setcap cap_sys_admin=eip`?

1 vote
0 answers
94 views
This question is a follow up to this question: https://unix.stackexchange.com/questions/792580/can-a-non-zero-not-0-not-root-user-run-a-process-with-capabilities-pid-e And it is likely related to my other question here: https://unix.stackexchange.com/questions/792601/do-child-processes-inherit-capabilities-of-parent-processes IN the comments of the previous question, I thought maybe setcap all=eip gave a process all capabilities, and that it would have more capabilities than cap_sys_admin. But I think my comment is wrong. Here's what I tried First, I want to make a copy of the bash binary and give it the setcap all=eip, then run the newly created bash binary to see if I have capabilities similar to those of a root user.
bob@bob:~$ getpcaps $$ # confirm current bash has no capabilities
7210: =
bob@bob:~$ sudo setcap all=eip /usr/local/bin/testing_bash
bob@bob:~$ getcap /usr/local/bin/testing_bash
/usr/local/bin/testing_bash =eip
bob@bob:~$ /usr/local/bin/testing_bash
bob@bob:~$ getpcaps $$
7329: =ep
So at first, it seems that setcap all=eip can allow bob to run testing_bash as if he were root. But upon more investigation, it seems that setcap all=eip has **fewer capabilities** than setcap cap_sys_admin=eip. Here's a followup experiment I tried that led me to this observation:
# trying the all=eip
bob@bob:~$ mkdir dir1
bob@bob:~$ sudo cp /bin/mount /usr/local/bin/testing_mount
bob@bob:~$ sudo setcap all=eip /usr/local/bin/testing_mount
bob@bob:~$ getcap /usr/local/bin/testing_mount # confirmed all capabilities exists
/usr/local/bin/testing_mount =eip
bob@bob:~$ /usr/local/bin/testing_mount -t tmpfs temp dir1
testing_mount: drop permissions failed.

# remove the testing_mount and try with cap_sys_admin=eip
bob@bob:~$ sudo rm -f /usr/local/bin/testing_mount
bob@bob:~$ sudo cp /bin/mount /usr/local/bin/testing_mount
bob@bob:~$ sudo setcap cap_sys_admin=eip /usr/local/bin/testing_mount
bob@bob:~$ getcap /usr/local/bin/testing_mount # confirmed cap_sys_admin exists
/usr/local/bin/testing_mount cap_sys_admin=eip
bob@bob:~$ /usr/local/bin/testing_mount -t tmpfs temp dir1
bob@bob:~$ echo 'test' > dir1/test.txt
bob@bob:~$ cat dir1/test.txt
test
bob@bob:~$ sudo umount -l dir1
bob@bob:~$ ls dir1
So it seems the cap_sys_admin has more capabilities than all? I am confused by this. Can anyone help clear up my confusion?
Asked by learningtech (631 rep)
Mar 17, 2025, 02:09 PM
Last activity: Mar 17, 2025, 02:35 PM