site
contact
newsHow to give super-powers to zeus
This is very interesting! I have a user named 'zeus', your normal
underprivileged user. How can I give zeus admin-privileges, without
actually becoming root -- because, that is what 'sudo' does, can bump up
to 'root' to perform admin operations.
I want to perform some admin operations, while still being zeus. Never mind why I want to do this, I just do.
The 'capsh' utility, in the 'libcap' package, can do it. I wrote about "Linux capabilities" recently:
http://bkhome.org/news/201805/improving-linux-capabilities.html
...however, I am not interested in the cap_sys_mount patch anymore.
Puppy Linux and derivatives such as Easy and Quirky, run as 'root',
with the ability to run Internet applications as user 'spot', and in
Easy in containers with unprivileged-root -- the latter is achieved by
using 'capsh' to drop privileges when chroot into a container.
Anyway, running as root, it would seem that capsh could be used to
switch to a normal user, yet keep any privileges that we want to keep.
In Easy, there is a user named 'zeus', that I created especially for
this experiment.
I thought that capsh would work (using "--secbits"), however, it
didn't. I am using libcap version 2.25, which the original author
stopped work on some years ago. I discovered that some further work has
been done on libcap, to add that missing/broken feature:
https://git.kernel.org/pub/scm/linux/kernel/git/morgan/libcap.git/commit/
...thanks Andrew!
I modified the source slightly, copied from the kernel source
/usr/src/linux-4.14.44/include/uapi/linux/capability.h, prctl.h, and
securebits.h, to libcap-2.25/libcap/include/uapi/linux/, and changed the
"DYNAMIC..." line in Make.Rules to this:
DYNAMIC := $(shell echo yes)
...so as to get dynamically liked executables.
Then just ran the usual:
# make
# new2dir make install
Running "capsh --print" prints out all of the capabilities. Now, if I
want to change to user zeus and keep all of those capabilities:
# capsh --keep=1 --user='zeus' --inh='cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read' --addamb='cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read' --
# whoami
zeus
# rm -f NewFile1
#
'NewFile1' was owned by root, and a user would not be able to delete
it, which I checked was the case when I just did a normal "su zeus".
Yippee, zeus has super-powers!
Note, the order is important:
capsh --keep=1 --user='zeus' --inh='...' --addamb='...' --
The "--" causes bash to run, so you have a new shell, and get back to root by typing "exit".