back to labs
Linux Capabilities
MediumLinux Security15-25 minThe brief
A helper binary at /usr/local/bin/netcheck was made setuid-root so ordinary users could run it — but setuid-root hands the program every root power just to open a raw ICMP socket. Fix it the least-privilege way: give the binary the single Linux capability it actually needs for raw sockets, and take away the setuid bit. Grading inspects the binary's file capabilities and its permission bits.
What you'll do
- Identify which capability a program needs for raw sockets instead of full root
- Grant that capability as an effective + permitted file capability
- Remove the setuid-root bit so the binary follows least privilege
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.