Linux capabilities: root split into (exploitable) pieces

Capabilities split root's privileges into units (e.g. CAP_NET_RAW, CAP_SETUID). A binary can hold some without being SUID. Some, though, are equivalent to root.

The dangerous ones

cap_setuid: the binary can become root (python -c 'import os; os.setuid(0); os.system("/bin/sh")' if python holds it). cap_dac_read_search: reads any file (shadow). cap_sys_admin: near-root. cap_sys_ptrace: injection into root processes.

getcap -r / 2>/dev/null   # list capabilities on binaries
# e.g.: /usr/bin/python3.11 = cap_setuid+ep  -> root

Defence

Assign the minimum necessary capabilities and never to interpreters (python, perl) or binaries with escapes. Audit with getcap -r /. In containers, drop all capabilities and add back selectively. Prefer capabilities to SUID, but with the same least-privilege discipline.