Playing with Linux kernel capabilities
š Intro As an experienced sysadmin, you might be familiar with the traditional āall-or-nothingā approach: if a shell or process is running with UID==0, it can do almost everything on a system; while a plain user process is restricted by some means: tipically it canāt open RAW sockets, canāt bind āprivilegedā ports under 1024, canāt change a file ownership and so on. Linux capabilities is a feature, gradually introduced starting from kernel 2.2, that permits a more fine-grained control over privileged operations, breaking the traditional binary root/non-root distinction. Just as by using sudo we can run specific commands as another user (even root), without permanently becoming that user, by using capabilities, we can grant a program only certain privileges without having to run it as root. ...