Defining Capability Restrictions

Limit the ability of a process to invoke sensitive kernel capabilities like net_admin or sys_rawio.

In this lesson, you will learn how to enforce the Principle of Least Privilege by restricting a process's ability to invoke sensitive kernel capabilities.

Even if a process runs as root, it doesn't necessarily need every power the kernel offers. Linux "capabilities" divide these powers into granular chunks. By default, processes inherit many capabilities from their parent. Using Mandatory Access Control (MAC) systems like AppArmor or SELinux, we can explicitly drop or deny these capabilities, ensuring a compromised service cannot perform high-risk actions like reconfiguring network interfaces or accessing raw hardware.

Using AppArmor for Capability Restriction

AppArmor makes restricting capabilities straightforward. If you have a web service that should never need to modify network settings (net_admin) or interact with hardware devices (sys_rawio), you can explicitly deny these in the profile.

Consider this snippet from an AppArmor profile:

profile web_server /usr/bin/web-service {
  # Allow standard file access...
  /var/www/html/ r,

  # Deny sensitive capabilities
  deny capability net_admin,
  deny capability sys_rawio,
}

By adding these deny rules, you create a "safety net." Even if an attacker exploits a buffer overflow in the web-service and gains root privileges, the kernel will block any syscalls requiring CAP_NET_ADMIN or CAP_SYS_RAWIO. The process will receive an "Operation not permitted" error, preventing the attacker from sniffing traffic, modifying routing tables, or directly accessing disk sectors.

Why This Matters

Capabilities like sys_rawio allow a process to read or write directly to memory or hardware, which is a gateway for rootkits. Meanwhile, net_admin allows for the manipulation of firewalls and network interfaces, which is a prime target for lateral movement. By defining capability restrictions, you significantly shrink the attack surface of your applications, ensuring that even a full application compromise does not translate into full kernel or hardware control.

Key Takeaway: Defining capability restrictions allows you to strip high-risk privileges from a process, ensuring that even a compromised root-level application remains confined by the kernel's security boundaries.