通过pam_cap配置特权失效的原因

缘由

阅读官网上对于pam_cap介绍的用户特权配置，如果不特别注意官网介绍中的几个关键词，通常配置后并不起效。

而这段对于非root的运行的特权设定与传递、传播的研究，均来自于这个疑问，所以，想再深入谈谈这个问题，而非蜻蜓点水。

官网配置说明

# /etc/security/capability.conf配置pam_cap作用的相关用户# Simple
cap_sys_ptrace               developer
cap_net_raw                  user1# Multiple capablities
cap_net_admin,cap_net_raw    jrnetadmin
# Identical, but with numeric values
12,13                        jrnetadmin
...

服务相关程序在PAM中配置启用pam_cap

借助其它已有程序完成启动

Nearly all applications/daemons which use PAM for authentication contain a configuration line:
@include common-auth. Thus, to set inheritable capabilities in all of these applications, add the following as the last line to /etc/pam.d/common-auth

auth optional pam_cap.so
可参见/etc/pam.d/中几个使用PAM程序的系统程序

To set inheritable capabilities for a user in a specific application, or in application(s) which do not >@include common-auth, add the line below to the application-specific file; e.g. /etc/pam.d/myapp

auth optional pam_cap.so

注意：独自配置应用程序，需要做到对PAM Aware

几个原因

su、runuser系统程序的PAM鉴权任务栈提前返回
单独配置服务并非PAM Aware，对于PAM模块没有进行接口编程，不能自动生效
inheritable capabilities并不能实现自动传递
libcap.so版本比较低

PAM鉴权任务栈提前返回

# CentOS7 su的鉴权任务栈
auth            sufficient      pam_rootok.so
auth            substack        system-auth
auth            include         postlogin
# 省略不重要的配置行，详细可见/etc/pam.d/su文件内容

# Ubuntu18.04 su鉴权任务栈虽然包括官网建议的common-auth，但是同样存在提前返回的可能
#
# The PAM configuration file for the Shadow `su' service
## This allows root to su without passwords (normal operation)
auth       sufficient pam_rootok.so# 省略不重要的配置行，详细可见/etc/pam.d/su文件内容
...
@include common-auth
...