I added a line to /etc/security/capability.conf so I can have a user who can read everything for backups, but not do everything root can.
cap_dac_read_search backupIf I add a password and shell for the user and then login, then I get the inherited capability:
backup$ capsh --print
Current: = cap_dac_read_search+iBut it doesn't show up when I su to the account:
user$ sudo su backup -s /bin/sh -c "capsh --print"
Current: =Naturally it works for sudo or su to root:
user$ sudo capsh --print
Current: = cap_chown,cap_dac_override, ...Is there a way to get the capabilities transferred when using su?
1 Answer
Install libpam-cap
In /etc/pam.d/su, make sure that pam_cap.so appears before pam_rootok.so
auth optional pam_cap.so
auth sufficient pam_rootok.soYou've already got capability.conf set up, so then you'll be good to go!
