LINUX CAPABILITIES REVISITED

Summary from the TLDR InfoSec newsletter

Linux capabilities enable fine-grained privilege management by dividing root powers into independent units, but attackers can abuse this by setting capabilities like cap_setuid on binaries (e.g., Python) to create stealthy backdoors without traditional SUID bits. Security teams should expand privilege escalation hunting beyond SUID/SGID files to include capability-enabled binaries using getcap -r / and monitor for setcap usage, as capabilities are stored in file inodes under security.capability attributes invisible to standard ls commands. Tools like LinPEAS and Elastic's detection rule for setcap utility usage help identify suspicious capability assignments, while getfattr can reveal hidden extended attributes that getcap decodes into human-readable capability flags.