Capabilities allows you to run commands without sudo. But sometimes it's hard
to figure out what capabilities it needs. Capmon monitors when processes check
capabilities(7) to
find out what they require. Run capmon '<COMMAND>' to track the capabilities
it accesses. It's important to not run your command with sudo since that
bypasses certain checks. Let the command fail at the first missing capability
check and add that capability, then try again and see if if fails on more.
Rinse and repeat until command runs successfully.
For an introduction to capabilities see A simpler life without sudo.
To use Capmon do
capmon '<cmd>'For example:
capmon 'ip link netns add test'It is recommended to enclose the command in quotes to avoid the shell from doing
any funny business with globbing or other special features, and to avoid Capmon
from interpreting the command's argument as its own. Capmon will run the command
with /bin/sh.
The output of the above command will be
[ip]
- [PASS] CAP_DAC_OVERRIDE
- [PASS] CAP_NET_ADMINbecause the ip command required the capabilities CAP_NET_ADMIN and
CAP_DAC_OVERRIDE for this particular task. Another example, ip link set dev tap0 up only requires CAP_NET_ADMIN.
If the user didn't have the capabilities it would instead report [FAIL] on one
of the capabilities. If it failed on the first of the two then it may not even
show the second since commands often bail out as soon as they fail to do
something.
If a command is still failing even though Capmon doesn't report anything there
is the flag -a or --all. This changes the place where it listens to another
location which covers many more checks, some of which are not always necessary
and are allowed to fail. This is not the default mode as to not confuse the
user with a bunch of capabilities that usually will not matter.
It is recommended to give Capmon the capabilities it needs. Running it with sudo will pass sudo rights to any child processes, preventing the return value of the cap check to be correct.
To use Capmon without sudo you must assign CAP_DAC_OVERRIDE and
CAP_SYS_ADMIN to yourself and to capmon. For a guide on how to set
capabilities see A simpler life without
sudo.
See Monitor mode documentation for usage of the legacy monitor mode.
make
sudo make install
The Makefile is a wrapper around CMake that will fetch the submodules and
output any build artifacts into the build/ directory.
These should be available on most modern Linux distributions.
sudo apt install cmake clang llvm libelf1 libelf-dev zlib1g-dev
CONFIG_PERF_EVENTS=y?- Linux kernel >= 5.10? (BPF CO-RE)
CONFIG_DEBUG_INFO_BTF=y- Linux kernel >= 5.8 (BPF ring buffer)
For more detailed explanation on building it and how it works see CONTRIBUTING.md