For each process, Lin\u00adux man\u00adages four UID\u2019s. When a process from a user with UID<\/span> 1000 is started\/forked, then the new process has nor\u00admal\u00adly also the UID<\/span> 1000.<\/p>\n\n\n\n How\u00adev\u00ader, with SUID<\/span>\/GUID<\/span> it becomes more com\u00adpli\u00adcat\u00aded, since process\u00ades can get oth\u00ader UIDs than the one of the caller. When a process like We can see al IDs via The four num\u00adbers mean the following:<\/p>\n\n\n\n Capa\u00adbil\u00adi\u00adties in Lin\u00adux are a more fine-grained access con\u00adtroll mech\u00ada\u00adnism then the tra\u00addi\u00adtion\u00adal user \/ root priv\u00adi\u00adleges. Instead of have root priv\u00adi\u00adleges, a process can be giv\u00aden spe\u00adcif\u00adic pow\u00ader\u00adful privileges.<\/p>\n\n\n\n Caba\u00adbil\u00adi\u00adties can be assigned (with +) or removed (with -) to exe\u00adcute\u00adables like this:<\/p>\n\n\n\n In this exam\u00adple, the capa\u00adbil\u00adi\u00adty To see the capa\u00adbil\u00adi\u00adties of a binary:<\/p>\n\n\n\npasswd<\/code> is cre\u00adat\u00aded from a \u201cnor\u00admal\u201d user, the process runs as root.<\/p>\n\n\n\n$ ls -lah \/usr\/bin\/passwd
-rws<\/strong>r-xr-x 1 root root 139K 7. Jul 15:30 \/usr\/bin\/passwd<\/pre>\n\n\n\n$ ps aux | grep passw
root<\/strong> 16041 0.0 0.0 10148 3200 pts\/4 S+ 17:14 0:00 passw<\/pre>\n\n\n\ngrep Uid \/proc\/$pid\/status<\/code>. In this case:<\/p>\n\n\n\n$ grep Uid \/proc\/16041\/status
Uid: 1000 0 0 0<\/pre>\n\n\n\n\n
Linux capabilities<\/h2>\n\n\n\n
sudo setcap cap_net_bind_service=+ep \/opt\/app<\/pre>\n\n\n\n
cap_net_bind_service<\/code> is grant\u00aded to the \/opt\/app<\/code> bina\u00adry. This means, that the appli\u00adca\u00adtion can bind to all ports, also <1024 as a nor\u00admal user. With\u00adout capa\u00adbil\u00adi\u00adties, only a root user can bind to ports below 1024.<\/p>\n\n\n\ngetcap \/usr\/bin\/myapp<\/pre>\n\n\n\n