Finding setuid binaries on Linux and BSD

Finding setuid binaries for Linux and BSD systems Why setuid? Binaries with the setuid bit enabled, are being executed as if they were running under the context of the root user. This enables normal (non-privileged) users to use special privileges, like opening sockets. While this seems unnecessary for a normal user, it is actually needed for simple commands like ping. Finding files with setuid bit To discover all files with the setuid bit, we can use the find command. Depending […]

Read more

Linux capabilities 101

Even seasoned Linux administrators may not be very aware of Linux capabilities. Still, they are used a lot and apply to most systems. This feature was added to Linux 2.2 kernel and gave us new possibilities regarding security. In this guide, we have an in-depth look how can leverage them.   What are Linux capabilities? Linux capabilities divide the privileges of the superuser into smaller and distinctive units. These units can then be independently be applied to processes, to give them a […]

Read more

Linux Capabilities: Hardening Linux binaries by removing setuid

Linux Capabilities Hardening Linux binaries by removing setuid Normally Unix based systems use two kind of processes: privileged and unprivileged. The first category is usually used for administrative purposes, like starting and stopping other processes, tuning the kernel and opening sockets. Root permissions The command ping is a great example why even small programs needs root permissions. In a first glance you might consider this tool to be simple: send a package to a host and see if it responds. The […]

Read more