Security.capability=0sAQAAAgAgAAAAAAAAAAAAAAAAAAA=Įxtended attributes are copied automatically by cp -a, but some other programs require a special flag: rsync -X.Ĭapabilities are set by package install scripts on Arch (e.g.
$ getcap /usr/bin/fping /usr/bin/fping cap_net_raw=ep $ getfattr -d -m "^security\\." /usr/bin/fping # file: usr/bin/fping The following example prints the capabilities of fping with getcap, and then prints the same data in its encoded form using getfattr: Extended attributes are supported by all major Linux file systems, including Ext2, Ext3, Ext4, Btrfs, JFS, XFS, and Reiserfs. This enables fping to be run by a normal user (as with the setuid method), while at the same time limiting the security consequences of a potential vulnerability in fping.Ĭapabilities are implemented on Linux using extended attributes ( xattr(7)) in the security namespace. Many packages make use of capabilities, such as CAP_NET_RAW being used for fping. Software developers are encouraged to replace uses of the powerful setuid attribute in a system binary with a more minimal set of capabilities. Capabilities (POSIX 1003.1e, capabilities(7)) provide fine-grained control over superuser permissions, allowing use of the root user to be avoided.
0 kommentar(er)
