0

I'm playing around with capsh and cap_dac_read_search capability, on a Ubuntu 20.04 machine (kernel version 5.4.0)

In theory the nobody user can read /etc/shadow if I gave cap_dac_read_search capability to the cat process, but it didn't work:

# capsh --caps="cap_setpcap+eip cap_setgid+eip cap_setuid+eip cap_dac_read_search+eip" --addamb=cap_dac_read_search --keep=1 --user=nobody -- -c "cat /etc/shadow"
cat: /etc/shadow: Permission denied

Then I tried something similar with cap_sys_module, the capability is not applied somehow as well:

# capsh --caps="cap_setuid+eip cap_setgid+eip cap_setpcap+eip cap_sys_module+eip" --addamb=cap_sys_module --keep=1 --user=nobody -- -c "modprobe xfs"
modprobe: ERROR: could not insert 'xfs': Operation not permitted

Does anyone know why?

daisy
  • 1,735
  • 3
  • 25
  • 39

0 Answers0