jperezduerto.info
Security in depth · Unit 22 · Lesson 7 of 44
Capabilities split privileged authority
Distinguish a capability boundary setting from authority currently held.
Helpful before thisLinux privilege escalation
After this lesson you can
- Explain why a capability in a bounding set is not automatically an effective grant.
One idea. One situation. One reasoned decision.
How it works
Linux capabilities divide privileged operations into named permissions. The effective set is used for capability checks. The permitted set constrains which capabilities a thread can make effective. A bounding set limits acquisition through relevant execution transitions; merely listing a capability there does not grant it.
Read the supplied record
C1 concerns a fictional time-display service. Its approved purpose is to read the clock and display opening hours, not change system time.
| Recorded property | Supplied value |
|---|---|
| Identity | Ordinary non-root service |
| Capability under review | CAP_SYS_TIME |
| Bounding set | Includes CAP_SYS_TIME |
| Permitted set | Empty |
| Effective set | Empty |
Assume this is the actual acting thread’s snapshot in the initial user namespace, with no credential transition between observation and the decision being discussed. CAP_SYS_TIME concerns setting the system clock and related time operations. C1 does not show that capability effective or permitted. The bounding entry is not evidence of current clock-changing authority.
The approved display task does not require that authority. Record the unused boundary allowance for owner review rather than proposing a new capability simply because its name appears in a report.
Do not turn this conclusion into “the service is harmless.” Ordinary resource permissions remain, and later execution or configuration changes require fresh evidence. Capability scope also depends on namespaces and the operation being checked; a name alone does not describe every reachable resource.
The key distinction: A limit on possible acquisition and a current grant are different evidence.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
What does C1 establish about CAP_SYS_TIME at the recorded moment?
Show the answer
Correct answer: It appears in the bounding set but is absent from the permitted and effective sets. The boundary record alone is not a grant. This snapshot does not show the capability available for the current privilege check.
Try it
- WriteWrite a review note for C1 distinguishing bounding, permitted, and effective sets. State whether clock-changing authority is currently shown, and whether the approved task needs it.