Как установить capacities в linux для пользователя?

Question

[freedom1b2830]

Хочу разобраться с возможностями в linux
Использую arch linux

Хочу реализовать такой сценарий:
1)захожу в пользователя через getty,
2)пишу ls /root,
3)вижу содержимое

Что нужно сделать ?

в /etc/security/capability.conf такое содержимое:

cap_dac_override admin
cap_dac_read_search admin

/etc/pam.d/login

#%PAM-1.0

auth       requisite    pam_nologin.so
auth       include      system-local-login
account    include      system-local-login
session    include      system-local-login
password   include      system-local-login

/etc/pam.d/system-local-login

#%PAM-1.0

auth      include   system-login
account   include   system-login
password  include   system-login
session   include   system-login

/etc/pam.d/system-login

#%PAM-1.0

auth       required   pam_shells.so debug
auth       requisite  pam_nologin.so 
auth       required   pam_cap.so  debug
auth       include    system-auth

account    required   pam_access.so debug
account    required   pam_nologin.so  
account    include    system-auth

password   include    system-auth

# pam_selinux.so close should be the first session rule
session    required   pam_selinux.so close debug
session    optional   pam_loginuid.so debug
session    optional   pam_keyinit.so       force revoke
session    include    system-auth


# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required   pam_selinux.so open debug
session    optional   pam_motd.so 
session    optional   pam_mail.so          dir=/var/spool/mail standard quiet debug
session    optional   pam_umask.so debug
-session   optional   pam_systemd.so debug
session    required   pam_env.so debug

capsh --print

Current: cap_wake_alarm=i
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore
Ambient set =
Current IAB: cap_wake_alarm
Securebits: 00/0x0/1'b0 (no-new-privs=0)
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
 secure-no-ambient-raise: no (unlocked)
uid=1000(admin) euid=1000(admin)
gid=1000(admin)
groups=1000(admin)
Guessed mode: HYBRID (4)

Answer 1

[chupasaurus]

1. Второе правило в capabilities.conf не должно работать т.к. на юзера работает предыдущее, так что у вас показания не сходятся...
   
2. Чтобы caps в capabilities.conf были не в bounding set, а ambient (и соотв. эффективными), надо задавать префикс ^
   
3. Складываем предыдущие пункты и получаем единственную строку в capabilities.conf:
   ^cap_dac_override,^cap_dac_read_search admin
   

Comments

[freedom1b2830]

Есть прогресс, но на ls /root не действует

Current: cap_dac_override,cap_dac_read_search=i
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore
Ambient set =
Current IAB: cap_dac_override,cap_dac_read_search
Securebits: 00/0x0/1'b0 (no-new-privs=0)
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
 secure-no-ambient-raise: no (unlocked)
uid=1073(admin) euid=1073(admin)
gid=1075(admin)
groups=1075(admin)
Guessed mode: HYBRID (4)