Linux capabilities

Related terms

• setuid and setgid — Mode bits that make an executable run with its owner's (or group's) identity instead of the caller's; on a directory, setgid makes new files inherit its group. They show as s in ls -l.
• Least privilege — Give a process or person only the permissions needed for the job and nothing more, so a mistake or compromise has a small blast radius.
• no_new_privs — A per-thread flag, set with prctl, that stops execve from granting more privilege through setuid bits or file capabilities. Once set it cannot be unset.

← All terms