--- name: "reducecap" section: "8" platform: "linux" package: "util-vserver" version: "0.30.216-pre3120-1.4+b11" release: "Debian 10 (Buster)" platforms: ["linux"] url: "https://new.carta.tech/reducecap" --- # reducecap(8) The reducecap utility is used to lower the capability ceiling of a process and child process. ## NAME reducecap - The reducecap utility is used to lower the capability ceiling of a process and child process. ## SYNTAX reducecap \[*options*\] \<*command arguments*\> ## DESCRIPTION The reducecap utility is used to lower the capability ceiling of a process and child process. Even setuid program won't be able to grab more capabilities. ## OPTIONS - **--secure** Removes all dangerous capabilities from the process executed.Specificly it removes: CAP\_LINUX\_IMMUTABLE CAP\_NET\_BROADCAST CAP\_NET\_ADMIN, CAP\_NET\_RAW CAP\_IPC\_LOCK CAP\_IPC\_OWNER CAP\_SYS\_MODULE CAP\_SYS\_RAWIO CAP\_SYS\_PACCT CAP\_SYS\_ADMIN CAP\_SYS\_BOOT CAP\_SYS\_NICE CAP\_SYS\_RESOURCE CAP\_SYS\_TIME CAP\_MKNOD. Leaving the following capabilities: CAP\_CHOWN CAP\_DAC\_OVERRIDE CAP\_DAC\_READ\_SEARCH CAP\_FOWNER CAP\_FSETID CAP\_KILL CAP\_SETGID CAP\_SETUID CAP\_NET\_BIND\_SERVICE CAP\_SYS\_CHROOT CAP\_SYS\_PTRACE CAP\_SYS\_TTY\_CONFIG CAP\_LEASE CAP\_QUOTACTL - **--show** Shows the current process capabilities. - **--flag** sets the security context flags. The option may be repeated several times. Here are the values: lock: The security context can't be changed. The process is trapped\ in this context. This is generally used for vservers because yoy\ do not want them to hide in new security context. sched: Each process in a security context contribute (lower) to the general\ priority of every processes in the context. Mostly, all processes\ in a security context take as much CPU together as one process\ not bound to this flag. Said again differently, a vserver having\ 100 active processes won't get more CPU than another vserver\ with a single active process. nproc: The "ulimit -u N" setting becomes global to the security context. It means\ the security context is not allowed to have more than N processes. private: No other processes, even root in security context 0, is allowed to\ enter this security context. Once a security context is setup\ with this flag, it is on its own. This also means that root\ in security context 0 won't be able to kill or interact with those\ processes. hideinfo: Hides various information in /proc. - **--LINUX\_IMMUTABLE** - **--NET\_BIND\_SERVICE** - **--NET\_BROADCAST** - **--NET\_ADMIN** - **--NET\_RAW** - **--IPC\_LOCK** - **--IPC\_OWNER** - **--SYS\_MODULE** - **--SYS\_RAWIO** - **--SYS\_PACCT** - **--SYS\_ADMIN** - **--SYS\_BOOT** - **--SYS\_NICE** - **--SYS\_RESOURCE** - **--SYS\_TIME** - **--MKNOD** All these options remove one capability. These options may be used after the **--secure** option to remove more capabilities. ## FILES */usr/sbin/reducecap* ## EXAMPLES \# You are not root now # What is the current capability ceiling cat /proc/self/status # The capBset line presents mostly 1s. /usr/sbin/reducecap --secure /bin/sh cat /proc/self/status # The capBset now shows many more 0s. # The capEff shows all 0s, you have no privilege now # We su to root su cat /proc/self/status # capEff is much better now, but there are still many 0s # Now we try to see if we are really root tail /var/log/messages # So far so good, we see the content /sbin/ifconfig eth0 /sbin/ifconfig eth0 down # No way, we can't configure the interface. In fact # we have lost most privilege normally assigned to root exit Please contribute some more, if you feel it's important. ## AUTHORS This Man page was written by Klavs Klavsen \ and based upon the helpful output from the program itself and the documentation on the Virtual Server site \ ## SEE ALSO [chcontext(8)](/chcontext/8.md) [rebootmgr(8)](/rebootmgr/8.md) [chbind(8)](/chbind/8.md) [vps(8)](/vps/8.md) [vpstree(8)](/vpstree/8.md) [vrpm(8)](/vrpm/8.md) [vserver(8)](/vserver/8.md) [vserver-stat(8)](/vserver-stat/8.md) [vtop(8)](/vtop/8.md)