Skip to content

Add support for Linux capabilities#458

Merged
troglobit merged 1 commit intofinit-project:masterfrom
aanderse:master
Dec 5, 2025
Merged

Add support for Linux capabilities#458
troglobit merged 1 commit intofinit-project:masterfrom
aanderse:master

Conversation

@aanderse
Copy link
Copy Markdown
Contributor

@aanderse aanderse commented Nov 28, 2025 •
edited
Loading

Implement Linux capability support for services, allowing them to run with minimal required privileges instead of running as root. This uses the modern IAB (Inheritable, Ambient, Bounding) API from libcap.

  • i am still working on the documentation but i thought it was worth pushing this as-is in case i'm going in the wrong direction
  • testing some simple scenarios on my system is fine so far 🤞

resolves #454

my motivation for this feature: i recently installed finit on my home server which runs caddy as a web server cap_net_bind_service would be very helpful here

troglobit
troglobit requested changes Nov 28, 2025
View reviewed changes
Copy link
Copy Markdown
Collaborator

@troglobit troglobit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor comment, so far this looks great! 💯 Really looking forward to reading the documentation so I might actually learn capabilities, finally 😅

Comment thread src/service.c Outdated
@aanderse aanderse force-pushed the master branch 3 times, most recently from 54ab7dd to 30e69be Compare November 30, 2025 16:34
@aanderse
Add support for Linux capabilities
be2a0ec 
Implement Linux capability support for services, allowing them to run
with minimal required privileges instead of running as root. This uses
the modern IAB (Inheritable, Ambient, Bounding) API from libcap.
@aanderse
Copy link
Copy Markdown
Contributor Author

aanderse commented Nov 30, 2025

my friend claude wrote the documentation for me... 😅 - but i'm impressed with the results!

@aanderse
Copy link
Copy Markdown
Contributor Author

aanderse commented Dec 3, 2025

i tested some services and everything worked as expected

@troglobit is there anything else you would like me to add or change before i mark this as ready for review?

@troglobit
Copy link
Copy Markdown
Collaborator

troglobit commented Dec 3, 2025

i tested some services and everything worked as expected

Cool!

@troglobit is there anything else you would like me to add or change before i mark this as ready for review?

Nope, if you're happy and feel ready then please go ahead 😊

@aanderse aanderse marked this pull request as ready for review December 3, 2025 12:02
troglobit
troglobit approved these changes Dec 5, 2025
View reviewed changes
Copy link
Copy Markdown
Collaborator

@troglobit troglobit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Top notch work!

@troglobit troglobit merged commit fee38d4 into finit-project:master Dec 5, 2025
4 checks passed
troglobit added a commit that referenced this pull request Dec 27, 2025
@troglobit
Fix #458: follow-up to be2a0ec, capabilities breaks root access
7c8ab79 
A user reports inability to re-start getty on the console after logging
out from a serial console.  After some digging it was found that the tty
was owned by the last user logged in and 600.  Even thougn getty runs as
root, it did not have permission to re-open the device node.

Turns out there was a minor bug in the new capability code that cleared
all capabilities from the root user.  A surprising amount of programs
worked just fine, but restarting getty gave it away.

The fix is to only call cap_setuid() when capabilities are set for the
service, otherwise we just fall back to setuid().

Also, refactor service_register() wrt. capabilities a bit so that we can
give users an early warning if the configuration is invalid, by adding a
parse_caps() helper function that calls cap_iab_from_text() to verify.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
@troglobit
Copy link
Copy Markdown
Collaborator

troglobit commented Dec 27, 2025

@aanderse I just pushed a few follow-up commits to this:

  • 7c8ab79: we found cases where capabilities broke services running as root, I made a a fix that I believe is in line with the documentation and the original intent
  • f6c69eb: documentation update to clarify behavior for services with @root

Could you have a look so it doesn't break your use-cases?

@aanderse
Copy link
Copy Markdown
Contributor Author

aanderse commented Dec 27, 2025

i'm so sorry for the hassle @troglobit - i am very confused how none of my daemons running as root had any trouble when running this code... then again, because of this code i was able to run most daemons as a non root user... 😅

the documentation and code changes make sense to me. i will give these changes a test today and report back. thank you!

@troglobit
Copy link
Copy Markdown
Collaborator

troglobit commented Dec 27, 2025

i'm so sorry for the hassle @troglobit - i am very confused how none of my daemons running as root had any trouble when running this code... then again, because of this code i was able to run most daemons as a non root user... 😅

Absolutely no problem, mate! I'm not entirely sure why the tty directive triggered that code path, I'll have another look at it and possibly simplify it. (A bit weird anyway that util.c:getuser() can return -1 — either we run as root, another user, or we don't run at all ... I think it's better if that always returns a valid UID)

the documentation and code changes make sense to me. i will give these changes a test today and report back. thank you!

Sounds good, and thanks a lot for taking the time to dig into this, update the docs, and actually test it. I really appreciate the effort you put into this, and any feedback you can give now 👍

@aanderse
Copy link
Copy Markdown
Contributor Author

aanderse commented Dec 27, 2025

i tested this on my home server which makes use of cap_net_bind_service on several services and found no regressions ✔️

thanks again @troglobit 🙇‍♂️

@troglobit
Copy link
Copy Markdown
Collaborator

troglobit commented Dec 28, 2025

i tested this on my home server which makes use of cap_net_bind_service on several services and found no regressions ✔️

Awesome, that's great news!

thanks again @troglobit 🙇‍♂️

Thank you for testing! 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@troglobit troglobit troglobit approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Capabilities support

2 participants

@aanderse @troglobit