Skip to content
hashkey.bond

Archivesecurity

Capabilities Beat Root-vs-Not-Root

Linux splits root privileges into capabilities. Grant the few you need and drop the rest.

Published
Reading time
1 min read

Running as root gives a process every privileged operation at once. Linux capabilities decompose that into named rights: CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, CAP_CHOWN, and so on.

In practice

  • A web server that binds port 80 needs CAP_NET_BIND_SERVICE, or a reverse proxy in front.
  • A packet capture tool needs CAP_NET_RAW and CAP_NET_ADMIN.
  • Most services need none.

Rules

  1. Start with --cap-drop=ALL, then add back only what fails.
  2. Set no_new_privs and a non-root UID so file capabilities cannot elevate.
  3. Remember CAP_SYS_ADMIN is essentially root; avoid it.
  4. Inside the process, use capset/libcap to drop capabilities after setup.

The caveat

Capabilities are coarse and historically buggy. They complement, not replace, seccomp, user namespaces, and a separate kernel for hostile workloads.

Takeaway: least privilege at the syscall level means dropping capabilities by default and adding named exceptions.