1CAPTEST:(8) System Administration Utilities CAPTEST:(8)
2
6 captest - a program to demonstrate capabilities
7
9 captest [ --drop-all | --drop-caps | --id ] [ --init-grp ] [ --lock ] [
10 --text ]
11
13 captest is a program that demonstrates and prints out the current
14 process capabilities. Each option prints the same report. It will out‐
15 put current capabilities. then it will try to access /etc/shadow
16 directly to show if that can be done. Then it creates a child process
17 that attempts to read /etc/shadow and outputs the results of that. Then
18 it outputs the capabilities that a child process would have.
19 You can also apply file system capabilities to this program to study
21 how they work. For example, filecap /usr/bin/captest chown. Then run
22 captest as a normal user. Another interesting test is to make captest
23 suid root so that you can see what the interaction is between root's
24 credentials and capabilities. For example, chmod 4755 /usr/bin/captest.
25 When run as a normal user, the program will see if privilege escalation
26 is possible. But do not leave this app setuid root after you are don
27 testing so that an attacker cannot take advantage of it.
28
31 --drop-all
32 This drops all capabilities and clears the bounding set.
33 --drop-caps
35 This drops just traditional capabilities.
36 --id This changes to uid and gid 99, drops supplemental groups, and
38 clears the bounding set.
39 --init-grp
41 This changes to uid and gid 99 and then adds any supplemental
42 groups that comes with that account. You would have add them
43 prior to testing because by default there are no supplemental
44 groups on account 99.
45 --text This option outputs the effective capabilities in text rather
47 than numerically.
48 --lock This prevents the ability for child processes to regain privi‐
50 leges if the uid is 0.
51
54 filecap(8), capabilities(7)
55
58 Steve Grubb
59Red Hat June 2009 CAPTEST:(8)