{"id":55251,"date":"2020-01-16T00:00:00","date_gmt":"2020-01-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/fajlovye-razresheniya-v-linux"},"modified":"2020-02-18T14:03:21","modified_gmt":"2020-02-18T11:03:21","slug":"fajlovye-razresheniya-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux","title":{"rendered":"File permissions in Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hello everyone. We are actively diving into work and already preparing many powerful launches for January. Among other things, we have announced recruitment for a new stream of the beloved course. Linux Administrator<\/a><\/noindex>Ahead of the launch, we traditionally share a translation of useful material.<\/i><\/p>\n

\"File
\n<\/p>\n

File permissions offer a safe alternative to SUID executables, but they may seem a bit confusing at first glance.<\/i><\/p><\/blockquote>\n

<\/a><\/noindex>
\nWe all know that binary files SUID<\/a><\/noindex> include are a poor solution from a security standpoint.<\/a><\/noindex>Fortunately, if your application requires certain limited privileges, there is a more effective method called file permissions.<\/a><\/noindex>.<\/p>\n

I'll save you time if you want to avoid reading the detailed article above: essentially, file permissions allow processes running under the root user, which therefore have the right to do anything, to retain certain capabilities limited to this list<\/a><\/noindex>, when they drop privileges and run as an unprivileged user. This means that if an attacker manages to compromise a process through a buffer overflow or another exploit, they will only be able to use the specific minimal privileges that the process genuinely needs.<\/p>\n

Permissions work great for services that typically always run as the root user, but what about command-line utilities? Fortunately, this is also supported, provided you have the right utilities installed. If you're using Ubuntu, for instance, you'll need the package libcap2-bin.<\/code>You will also need to run a non-archaic kernel (starting from version 2.6.24<\/b>).<\/p>\n

). These features allow you to associate permissions with executables similarly to configuring the SUID bit, but only for a specific set of permissions. The utility setcap<\/code> is used to add and remove permissions from a file.<\/p>\n

The first step is to choose the permissions you need. For this article, I assume there is a network diagnostic tool called tracewalk,<\/code>which should be able to use raw sockets.<\/a><\/noindex>Usually, this requires the application to run as the root user, but upon examination list <\/a><\/noindex>, it turns out that only the permission CAP_NET_RAW is needed.<\/code>.<\/p>\n

Assuming you are in the directory where the binary file is located tracewalk,<\/code>, you can add this capability as follows:<\/p>\n

sudo setcap cap_net_raw=eip tracewalk<\/code><\/pre>\n
\nFor now, ignore the suffix =eip<\/code> for the capability; I will explain this in a moment. Note that the capability name is in lowercase. You can now check if you set the permissions correctly with:<\/p>\n
setcap -v cap_new_raw=eip tracewalk<\/code><\/pre>\n
\nOr you can list all capabilities set for the given executable file:<\/p>\n
getcap tracewalk\n<\/code><\/pre>\n
\nFor your information, you can also remove all capabilities from the executable file with:<\/p>\n
setcap -r tracewalk<\/code><\/pre>\n
\nAt this stage, you should be able to run the executable as an unprivileged user, and it should be able to work with raw sockets, but without any other privileges that the root user has.<\/p>\n
So, what does this strange suffix mean? =eip<\/code>? \u0417\u0434\u0435\u0441\u044c \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u0438\u043a\u0430 \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u0440\u043e\u0434\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u041a\u0430\u0436\u0434\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0438\u043c\u0435\u0435\u0442 \u0442\u0440\u0438 \u043d\u0430\u0431\u043e\u0440\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u2014 effective, inheritable, and permitted (effective, inheritable, and permitted)<\/i>:<\/p>\n