Setuid marks an executable so that a nonprivileged process gains the designated privilege when it runs that executable. This mechanism supports commands such as sudo and ping, but Linux no longer treats root privilege as one indivisible power: capabilities divide it into separately controlled units. section 10.2
Understand setuid through its relationship with Linux capabilities and rootless containers:
- A process executing a setuid program can acquire root-level capabilities, subject to the process's capability bounding set. section 10.2
- Capabilities such as CAP_SETUID and CAP_SETGID let processes change identifiers, while CAP_CHOWN controls ownership changes. section 6.1.1
- Inside a user namespace, these capabilities are namespaced: CAP_SETUID can change identifiers only to values mapped within that namespace. section 6.1.1
- Rootless Podman therefore does not make every apparent root process equivalent to host root; namespace mappings and capabilities constrain its authority. section 6.1.1
Inspecting the privilege boundary
Run `capsh --print` to inspect the current and bounding capability sets. A process may show an empty current set while still retaining a bounding set that limits what a setuid program can obtain. section 10.2
Listing 10.2 capsh –print showing the capabilities available to your user’s process
$ capsh --print Current: = #1 Bounding set = #2 cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill, cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service, cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner, cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct, cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time, cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control, cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm, cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore Ambient set = ... uid=3267(dwalsh) euid=3267(dwalsh) #3 gid=3267(dwalsh)
Inspect the capability listing, effective identifiers, and bounding set reported by `capsh --print`. section 10.2
