User Permissions, Capabilities, Namespaces, cgroups

Updated

October 30, 2026

User Permissions, Capabilities, Namespaces, cgroups

Linux security has advanced far beyond traditional discretionary access controls (POSIX user/group permissions). Modern systems enforce least privilege through granular kernel primitives:

+-----------------------------------------------------------+
|                   Linux Isolation Primitives              |
|                                                           |
| 1. Discretionary Access Control (DAC: UID / GID / rwx)    |
|         |                                                 |
|         v                                                 |
| 2. POSIX Capabilities (Surgical root privileges)          |
|    - CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, CAP_DAC_OVERRIDE|
|         |                                                 |
|         v                                                 |
| 3. Namespaces (Virtualized views of global resources)     |
|    - pid, net, mnt, ipc, uts, user, cgroup                |
|         |                                                 |
|         v                                                 |
| 4. Control Groups v2 (Resource consumption throttling)    |
|    - CPU shares, memory caps, IO bandwidth, max PIDs     |
+-----------------------------------------------------------+

1. POSIX Capabilities: Deconstructing Root

Traditionally, a process either ran as standard unprivileged user (UID \(\neq 0\)) or as omnipotent superuser (UID \(= 0\), root). If a web server needed to bind to privileged port 80/443, it had to run as root, exposing the entire operating system if the server was compromised.

POSIX Capabilities split root’s powers into distinct privileges: - CAP_NET_BIND_SERVICE: Bind sockets to port numbers below 1024. - CAP_NET_RAW: Construct raw packets (used by ping). - CAP_SYS_ADMIN: Mount filesystems, configure network interfaces, load BPF programs. - CAP_SYS_CHROOT: Invoke chroot().

Instead of making binaries setuid root (chmod u+s), assign fine-grained capabilities:

# Grant ping permission to send ICMP packets without running as full root:
# setcap cap_net_raw+ep /usr/bin/ping

2. Linux Namespaces

Namespaces provide isolated virtualized instances of global kernel resources. They are the core building block of Linux container engines:

  • Mount (mnt): Private filesystem mount table.
  • PID (pid): Independent process tree numbering. The process sees itself as PID 1 inside the namespace.
  • Network (net): Private virtual network devices, routing tables, and firewall rules.
  • IPC (ipc): Isolated System V IPC and POSIX message queues.
  • UTS (uts): Private hostname and domain name.
  • User (user): Maps an unprivileged user on the host system to UID 0 (root) inside the namespace without granting actual host root privileges!

3. Control Groups (cgroups v2)

While namespaces isolate what a process can see, cgroups v2 limit how much physical hardware it can consume:

# Creating a restricted slice under /sys/fs/cgroup:
# mkdir /sys/fs/cgroup/sandbox
# echo "500M" > /sys/fs/cgroup/sandbox/memory.max
# echo "50000 100000" > /sys/fs/cgroup/sandbox/cpu.max  # Max 50% of 1 CPU core
# echo 100 > /sys/fs/cgroup/sandbox/pids.max            # Fork-bomb protection!

# Attach a process to the sandbox:
# echo $$ > /sys/fs/cgroup/sandbox/cgroup.procs