Hi team, if you run "setcap cap_net_raw" without the file name argument this results in running the setcap command on each and every file of the system. You do not get any warning. I accidently ran this command and forgot to add the file name argument and found out that more than 100.000 files were changed (all in the /opt directory). Fortunately I use bareos.org for backup, and therefore was able to recreate the original files. This is an x86_64 system, libcap-progs version 2.25 (cannot verify if this attitude still exists in latest verstions). Thank you!
Can't confirm: $ setcap cap_net_raw fatal error: Invalid argument usage: setcap [-h] [-q] [-v] [-n <rootid>] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) <filenameN> ] Note <filename> must be a regular (non-symlink) file. -r remove capability from file - read capability text from stdin <capsN> cap_from_text(3) formatted file capability -h this message and exit status 0 -q quietly -v validate supplied capability matches file -n <rootid> write a user namespace limited capability --license display the license info libcap-2.48-8.fc38.x86_64
That doesn't look plausible with that version of libcap: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/tree/progs/setcap.c?h=libcap-2.25 Indeed: $ wget https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-2.25.tar.gz $ tar zvfx libcap-2.25.tar.gz $ cd libcap-2.25/ $ make $ cd progs $ sudo -s # # LD_LIBRARY_PATH=../libcap ./setcap cap_net_raw usage: setcap [-q] [-v] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) <filenameN> ] Note <filename> must be a regular (non-symlink) file.
Thank you for investigating, yes, this is what I receive, too, but the command run(s) nevertheless. Did you check that the files did not get changed (e. g. by checking the modification time)? To me, it is not really plausible. Only (many!) files in /opt were changed. The files were changed in a time frame of about 5 minutes. The setcap is not aliased in any way, there is no change of the binaries, no hacker activities, and such. Martin. P. S. Any other explanation? Well, the "rpm -Va >/tmp/rpm" resulted in a file 1000 times bigger than usual, due to the fact that the modification time was changed on the files.
Yes, I did look to confirm no capabilities were actually added to any file. The program, setcap, is single threaded. If it exits, it should have no further consequences. If what you observe is happening, it is not coming from the libcap sources.
Thank you again, I cannot add any useful information here.