https://github.com/demindiro/runcap
Run programs temporarily with capabilities as non-root
https://github.com/demindiro/runcap
Last synced: over 1 year ago
JSON representation
Run programs temporarily with capabilities as non-root
- Host: GitHub
- URL: https://github.com/demindiro/runcap
- Owner: Demindiro
- License: agpl-3.0
- Created: 2022-01-23T08:12:43.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2022-01-23T08:12:54.000Z (over 4 years ago)
- Last Synced: 2025-02-07T06:26:48.072Z (over 1 year ago)
- Language: C
- Homepage: https://git.sr.ht/~demindiro/runcap
- Size: 14.6 KB
- Stars: 0
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# runcap
This program allows granting specific capabilities to non-root processes.
## Why not capsh?
`capsh` is (IMO) awful to use and I couldn't find an alternative. For some
reason the Debian version misses `--addamb` too which makes it effectively
useless. I also can't figure out how to make it `exec()` ("chainload") a
program.
## How it works
- Set UID & GID (with `set_uid` and `set_groups`, which are special).
- Put a list of capabilities in the effective, inheritable and permitted
sets.
- Put those capabilities in the ambient set.
- Execute the program.
## TODO
It may be worth setting the bounding set properly.