Gsyfuy

A ​Note ​on ​N!

Size of electromagnet needed to replicate Earth's magnetic field

Is there a way to get a compiler for the original B programming language?

Examples of non trivial equivalence relations , I mean equivalence relations without the expression " same ... as" in their definition?

Is there really no use for MD5 anymore?

Can SQL Server create collisions in system generated constraint names?

Do I have an "anti-research" personality?

What does the "ep" capability mean?

Why does nature favour the Laplacian?

How would one muzzle a full grown polar bear in the 13th century?

Does holding a wand and speaking its command word count as V/S/M spell components?

How do I deal with a coworker that keeps asking to make small superficial changes to a report, and it is seriously triggering my anxiety?

Was there a Viking Exchange as well as a Columbian one?

How come there are so many candidates for the 2020 Democratic party presidential nomination?

Will tsunami waves travel forever if there was no land?

In order to check if a field is required or not, is the result of isNillable method sufficient?

Why other Westeros houses don't use wildfire?

Is the 5 MB static resource size limit 5,242,880 bytes or 5,000,000 bytes?

Phrase for the opposite of "foolproof"

How to creep the reader out with what seems like a normal person?

What is the most expensive material in the world that could be used to create Pun-Pun's lute?

Was there a shared-world project before "Thieves World"?

How to have a sharp product image?

What does it mean to express a gate in Dirac notation?

What does the “ep” capability mean?

Unable to set capability CAP_SETFCAP by userWhat does this iptable rule mean?Granting service specific capabilitiesWhat does :source % mean?Does every syscall require at most 1 capability on Linux?Better use ACL or Capability to let users start a service?Does a process that have the root user always have all of the capabilities available in Linux?Does macOS and Solaris have “capabilities”?Difference between file capability and process capabilityWhat does the '.' (dot) mean?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}

3

root@macine:~# getcap ./some_bin

./some_bin =ep

What does "ep" mean? What are the capabilities of this binary?

linux capabilities

share|improve this question

edited 2 hours ago

muru

38.1k590166

asked 4 hours ago

JamesJames

213

New contributor

James is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  capabilities(7) have nothing to do with selinux. That file has all possible capabilities set.
  
  – mosvy
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  vulp3cula.gitbook.io/hackers-grimoire/post-exploitation/…
  
  – Jesse_b
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Jesse_b that's wrong, there's no "special case" of empty capabilities. That guy was simply confused by the syntax. setcap =ep file will turn all capabilities on, setcap = file will turn them all off (make them empty) and setcap -r file will remove them completely.
  
  – mosvy
  7 mins ago
  
  
  

  
  
  
  

add a comment | 

3

root@macine:~# getcap ./some_bin

./some_bin =ep

What does "ep" mean? What are the capabilities of this binary?

linux capabilities

share|improve this question

edited 2 hours ago

muru

38.1k590166

asked 4 hours ago

JamesJames

213

New contributor

James is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  capabilities(7) have nothing to do with selinux. That file has all possible capabilities set.
  
  – mosvy
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  vulp3cula.gitbook.io/hackers-grimoire/post-exploitation/…
  
  – Jesse_b
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Jesse_b that's wrong, there's no "special case" of empty capabilities. That guy was simply confused by the syntax. setcap =ep file will turn all capabilities on, setcap = file will turn them all off (make them empty) and setcap -r file will remove them completely.
  
  – mosvy
  7 mins ago
  
  
  

  
  
  
  

add a comment | 

root@macine:~# getcap ./some_bin

./some_bin =ep

What does "ep" mean? What are the capabilities of this binary?

linux capabilities

share|improve this question

edited 2 hours ago

muru

38.1k590166

asked 4 hours ago

JamesJames

213

New contributor

James is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

root@macine:~# getcap ./some_bin

./some_bin =ep

share|improve this question

edited 2 hours ago

muru

38.1k590166

asked 4 hours ago

JamesJames

213

New contributor

James is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

edited 2 hours ago

muru

38.1k590166

asked 4 hours ago

JamesJames

213

New contributor

James is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

edited 2 hours ago

muru

38.1k590166

edited 2 hours ago

muru

38.1k590166

asked 4 hours ago

JamesJames

213

New contributor

James is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 4 hours ago

JamesJames

213

2 Answers
2

active

oldest

votes

5

# getcap ./some_bin

./some_bin =ep

That file has ALL the capabilites set in the effective(e) and permitted(p) set.

In the textual representation of capabilities, a leading = is equivalent to all=.
From the cap_to_text(3) manpage:

In the case that the leading operator is =, and no list of capabilities is provided, the action-list is assumed to refer to all capabilities. For example, the following three clauses are equivalent to each
other (and indicate a completely empty capability set): all=; =;
cap_chown,<every-other-capability>=.

Such a binary can do whatever it pleases, limited only by the capability bounding set, which on a desktop system includes everything (otherwise setuid binaries like su wouldn't work as expected).

Notice that this is only a "gotcha" of the textual representation used by libpcap: in the security.capability extended attribute of the file for which getcap will print /file/path =ep, all the meaningful bits are effectively on; for an empty security.capability, /file/path = (with the = not followed by anything) will be returned instead.

---

If someone is still not convinced about all that, here is a small experiment:

# cp /bin/ping /tmp/ping   # will wipe setuid bits and extented attributes

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

# setcap =ep /tmp/ping

# su user -c '/tmp/ping localhost'  # will work because of cap_net_raw

PING localhost(localhost (::1)) 56 data bytes

64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.073 ms

^C

# setcap = /tmp/ping

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

share|improve this answer

edited 1 hour ago

answered 3 hours ago

mosvymosvy

10.9k11340

add a comment | 

5

The capabilities are put in the permitted set (p), and all permitted capabilities are copied into the effective set (e). There does not seem to be any capabilities in your example (where did you get it from?).

The e is used for legacy programs (possibly most programs at the current time), that is programs that don't know about capabilities, so can not them-selves copy capabilities from permitted to effective.

share|improve this answer

answered 4 hours ago

ctrl-alt-delorctrl-alt-delor

12.7k52663

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

James is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f515881%2fwhat-does-the-ep-capability-mean%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

5

# getcap ./some_bin

./some_bin =ep

That file has ALL the capabilites set in the effective(e) and permitted(p) set.

In the textual representation of capabilities, a leading = is equivalent to all=.
From the cap_to_text(3) manpage:

In the case that the leading operator is =, and no list of capabilities is provided, the action-list is assumed to refer to all capabilities. For example, the following three clauses are equivalent to each
other (and indicate a completely empty capability set): all=; =;
cap_chown,<every-other-capability>=.

Such a binary can do whatever it pleases, limited only by the capability bounding set, which on a desktop system includes everything (otherwise setuid binaries like su wouldn't work as expected).

Notice that this is only a "gotcha" of the textual representation used by libpcap: in the security.capability extended attribute of the file for which getcap will print /file/path =ep, all the meaningful bits are effectively on; for an empty security.capability, /file/path = (with the = not followed by anything) will be returned instead.

---

If someone is still not convinced about all that, here is a small experiment:

# cp /bin/ping /tmp/ping   # will wipe setuid bits and extented attributes

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

# setcap =ep /tmp/ping

# su user -c '/tmp/ping localhost'  # will work because of cap_net_raw

PING localhost(localhost (::1)) 56 data bytes

64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.073 ms

^C

# setcap = /tmp/ping

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

share|improve this answer

edited 1 hour ago

answered 3 hours ago

mosvymosvy

10.9k11340

add a comment | 

5

# getcap ./some_bin

./some_bin =ep

That file has ALL the capabilites set in the effective(e) and permitted(p) set.

In the textual representation of capabilities, a leading = is equivalent to all=.
From the cap_to_text(3) manpage:

In the case that the leading operator is =, and no list of capabilities is provided, the action-list is assumed to refer to all capabilities. For example, the following three clauses are equivalent to each
other (and indicate a completely empty capability set): all=; =;
cap_chown,<every-other-capability>=.

Such a binary can do whatever it pleases, limited only by the capability bounding set, which on a desktop system includes everything (otherwise setuid binaries like su wouldn't work as expected).

Notice that this is only a "gotcha" of the textual representation used by libpcap: in the security.capability extended attribute of the file for which getcap will print /file/path =ep, all the meaningful bits are effectively on; for an empty security.capability, /file/path = (with the = not followed by anything) will be returned instead.

---

If someone is still not convinced about all that, here is a small experiment:

# cp /bin/ping /tmp/ping   # will wipe setuid bits and extented attributes

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

# setcap =ep /tmp/ping

# su user -c '/tmp/ping localhost'  # will work because of cap_net_raw

PING localhost(localhost (::1)) 56 data bytes

64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.073 ms

^C

# setcap = /tmp/ping

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

share|improve this answer

edited 1 hour ago

answered 3 hours ago

mosvymosvy

10.9k11340

add a comment | 

# getcap ./some_bin

./some_bin =ep

That file has ALL the capabilites set in the effective(e) and permitted(p) set.

In the textual representation of capabilities, a leading = is equivalent to all=.
From the cap_to_text(3) manpage:

In the case that the leading operator is =, and no list of capabilities is provided, the action-list is assumed to refer to all capabilities. For example, the following three clauses are equivalent to each
other (and indicate a completely empty capability set): all=; =;
cap_chown,<every-other-capability>=.

Such a binary can do whatever it pleases, limited only by the capability bounding set, which on a desktop system includes everything (otherwise setuid binaries like su wouldn't work as expected).

Notice that this is only a "gotcha" of the textual representation used by libpcap: in the security.capability extended attribute of the file for which getcap will print /file/path =ep, all the meaningful bits are effectively on; for an empty security.capability, /file/path = (with the = not followed by anything) will be returned instead.

---

If someone is still not convinced about all that, here is a small experiment:

# cp /bin/ping /tmp/ping   # will wipe setuid bits and extented attributes

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

# setcap =ep /tmp/ping

# su user -c '/tmp/ping localhost'  # will work because of cap_net_raw

PING localhost(localhost (::1)) 56 data bytes

64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.073 ms

^C

# setcap = /tmp/ping

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

share|improve this answer

edited 1 hour ago

answered 3 hours ago

mosvymosvy

10.9k11340

# cp /bin/ping /tmp/ping   # will wipe setuid bits and extented attributes

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

# setcap =ep /tmp/ping

# su user -c '/tmp/ping localhost'  # will work because of cap_net_raw

PING localhost(localhost (::1)) 56 data bytes

64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.073 ms

^C

# setcap = /tmp/ping

# su user -c '/tmp/ping localhost'

ping: socket: Operation not permitted

share|improve this answer

edited 1 hour ago

answered 3 hours ago

mosvymosvy

10.9k11340

answered 3 hours ago

mosvymosvy

10.9k11340

answered 3 hours ago

mosvymosvy

10.9k11340

5

The capabilities are put in the permitted set (p), and all permitted capabilities are copied into the effective set (e). There does not seem to be any capabilities in your example (where did you get it from?).

The e is used for legacy programs (possibly most programs at the current time), that is programs that don't know about capabilities, so can not them-selves copy capabilities from permitted to effective.

share|improve this answer

answered 4 hours ago

ctrl-alt-delorctrl-alt-delor

12.7k52663

add a comment | 

5

The capabilities are put in the permitted set (p), and all permitted capabilities are copied into the effective set (e). There does not seem to be any capabilities in your example (where did you get it from?).

The e is used for legacy programs (possibly most programs at the current time), that is programs that don't know about capabilities, so can not them-selves copy capabilities from permitted to effective.

share|improve this answer

answered 4 hours ago

ctrl-alt-delorctrl-alt-delor

12.7k52663

add a comment | 

The capabilities are put in the permitted set (p), and all permitted capabilities are copied into the effective set (e). There does not seem to be any capabilities in your example (where did you get it from?).

The e is used for legacy programs (possibly most programs at the current time), that is programs that don't know about capabilities, so can not them-selves copy capabilities from permitted to effective.

share|improve this answer

answered 4 hours ago

ctrl-alt-delorctrl-alt-delor

12.7k52663

share|improve this answer

answered 4 hours ago

ctrl-alt-delorctrl-alt-delor

12.7k52663

answered 4 hours ago

ctrl-alt-delorctrl-alt-delor

12.7k52663

answered 4 hours ago

ctrl-alt-delorctrl-alt-delor

12.7k52663