In this lesson, you will learn how to restrict time-setting capabilities to prevent attackers from bypassing critical security controls like certificate validation.
Why Clock Integrity Matters
In a hardened Linux environment, the system clock is more than just a reference for user convenience; it is a fundamental security primitive. Many cryptographic operations—specifically TLS/SSL certificate validation—rely on the system clock to verify that a certificate is not expired and not "not yet valid."
If an attacker gains sufficient privileges to manipulate the system time, they can force the clock to fall within the validity period of a stolen or self-signed certificate, effectively bypassing authentication. This "time-shifting" attack can render your HTTPS, VPN, and signed package verification systems useless.
Restricting Access with Capabilities
By default, the CAP_SYS_TIME capability grants a process the authority to set the system clock. In a secure system, only the dedicated time-synchronization daemon (like systemd-timesyncd or chronyd) should possess this power.
To harden your system, you must ensure that no user-space utilities or compromised service processes retain this capability. You can check which processes have this permission using getpcaps on the process ID:
# Check capabilities of a running process
getpcaps <PID>
In a production environment, you should use Mandatory Access Control (MAC) frameworks—such as AppArmor or SELinux—to explicitly deny the adjtime and settimeofday system calls to any application that does not strictly require them.
For instance, in an AppArmor profile, you would ensure the capability sys_time is absent, preventing an exploit from reaching the system clock even if the process has been hijacked:
# Example profile snippet
profile my-app-service {
# Deny clock manipulation
deny capability sys_time,
...
}
By stripping CAP_SYS_TIME from non-essential services, you shrink your attack surface. Even if an attacker achieves code execution in a web server or user utility, they remain trapped within the "present" time, ensuring that certificate-based security remains intact.
Key Takeaway: By removing CAP_SYS_TIME from non-privileged processes and using MAC policies to restrict clock-related syscalls, you prevent attackers from manipulating system time to bypass certificate validation.