srl
Capabilities Abuse
What are Capabilities? Linux capabilities are a security feature that allows specific privileges to be granted to processes, enabling actions that would otherwise be restricted to root. Capabilities break up the monolithic root privilege into smaller, independently grantable units. Each unit can be assigned to a process or binary without granting full root. One common vulnerability is using capabilities to grant privileges to processes that are not adequately sandboxed or isolated, allowing privilege escalation and access to sensitive information. Another vulnerability is misuse or overuse: a process may hold more capabilities than it actually needs, widening the attack surface. Capabilities are stored as extended attributes (security.capability) and are not visible in ls -l — unlike SUID, they must be enumerated with getcap.