$ getcap /usr/bin/ping
/usr/bin/ping = cap_net_raw+ep

$ sudo setcap 'cap_net_bind_service=+ep' /path/to/myserver
$ getcap /path/to/myserver
/path/to/myserver = cap_net_bind_service+ep

$ sudo setcap -r /path/to/myserver

$ capsh --print
Current: =
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,...
Ambient set =
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
uid=1000(user)
gid=1000(user)
groups=1000(user),...

$ sudo capsh --caps='cap_net_raw+eip cap_setuid,cap_setgid+ep' \
  --keep=1 --user=nobody --addamb=cap_net_raw -- -c /path/to/program

#include <sys/capability.h>
#include <stdio.h>

int main() {
    cap_t caps;
    char *caps_text;
    
    // 현재 프로세스의 capabilities 가져오기
    caps = cap_get_proc();
    if (caps == NULL) {
        perror("cap_get_proc");
        return 1;
    }
    
    // 텍스트 형식으로 변환
    caps_text = cap_to_text(caps, NULL);
    printf("Current capabilities: %s\n", caps_text);
    
    // 메모리 해제
    cap_free(caps_text);
    cap_free(caps);
    
    return 0;
}

$ gcc -o check_caps check_caps.c -lcap

#include <sys/capability.h>
#include <sys/prctl.h>
#include <stdio.h>
#include <stdlib.h>

int drop_all_caps_except(cap_value_t keep_cap) {
    cap_t caps;
    cap_value_t cap_list[1];
    
    // 빈 capability 세트 생성
    caps = cap_init();
    if (caps == NULL) {
        perror("cap_init");
        return -1;
    }
    
    // 유지할 capability 설정
    cap_list[0] = keep_cap;
    if (cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET) == -1 ||
        cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) {
        perror("cap_set_flag");
        cap_free(caps);
        return -1;
    }
    
    // 프로세스에 적용
    if (cap_set_proc(caps) == -1) {
        perror("cap_set_proc");
        cap_free(caps);
        return -1;
    }
    
    cap_free(caps);
    return 0;
}

int main() {
    // CAP_NET_BIND_SERVICE만 유지하고 나머지 제거
    if (drop_all_caps_except(CAP_NET_BIND_SERVICE) == -1) {
        fprintf(stderr, "Failed to drop capabilities\n");
        return 1;
    }
    
    printf("Successfully dropped all capabilities except CAP_NET_BIND_SERVICE\n");
    
    // 여기서 80번 포트 바인딩 등의 작업 수행
    // ...
    
    return 0;
}

# 1. Node.js 바이너리에 capability 부여
$ sudo setcap 'cap_net_bind_service=+ep' /usr/bin/node

# 2. 일반 사용자로 서버 실행
$ node server.js  # 80번 포트 사용 가능!

# 3. 확인
$ getcap /usr/bin/node
/usr/bin/node = cap_net_bind_service+ep

const http = require('http');

const server = http.createServer((req, res) => {
    res.writeHead(200, {'Content-Type': 'text/plain'});
    res.end('Hello from port 80 without root!\n');
});

// 80번 포트에서 리스닝 (root 권한 불필요!)
server.listen(80, () => {
    console.log('Server running on port 80');
    
    // 보안 강화: 서버 시작 후 capability 제거
    try {
        process.setuid('nobody');
        console.log('Dropped privileges to nobody');
    } catch (err) {
        console.error('Failed to drop privileges:', err);
        process.exit(1);
    }
});

# Python 인터프리터에 capability 부여
$ sudo setcap 'cap_net_raw,cap_net_admin=+ep' /usr/bin/python3.9

# 또는 특정 스크립트를 바이너리로 만들어서 설정
$ pip install pyinstaller
$ pyinstaller --onefile packet_sniffer.py
$ sudo setcap 'cap_net_raw=+ep' dist/packet_sniffer

#!/usr/bin/env python3
import socket
import struct
import sys

def packet_sniffer():
    try:
        # RAW 소켓 생성 (CAP_NET_RAW 필요)
        sock = socket.socket(socket.AF_PACKET, 
                           socket.SOCK_RAW, 
                           socket.ntohs(3))
    except PermissionError:
        print("Error: CAP_NET_RAW capability required!")
        print("Run: sudo setcap 'cap_net_raw=+ep' /path/to/this/script")
        sys.exit(1)
    
    print("Packet sniffer started (Ctrl+C to stop)...")
    
    try:
        while True:
            raw_data, addr = sock.recvfrom(65535)
            
            # Ethernet 헤더 파싱
            dest_mac, src_mac, eth_proto = struct.unpack('! 6s 6s H', raw_data[:14])
            
            print(f"Packet from {format_mac(src_mac)} to {format_mac(dest_mac)}")
            
    except KeyboardInterrupt:
        print("\nStopping sniffer...")
        sock.close()

def format_mac(mac_bytes):
    return ':'.join(f'{b:02x}' for b in mac_bytes)

if __name__ == '__main__':
    packet_sniffer()

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <sys/time.h>
#include <sys/capability.h>
#include <unistd.h>

int set_system_time(time_t new_time) {
    struct timeval tv;
    tv.tv_sec = new_time;
    tv.tv_usec = 0;
    
    // CAP_SYS_TIME이 필요한 작업
    if (settimeofday(&tv, NULL) == -1) {
        perror("settimeofday");
        return -1;
    }
    
    return 0;
}

int drop_capabilities() {
    cap_t caps = cap_init();
    if (caps == NULL) {
        perror("cap_init");
        return -1;
    }
    
    if (cap_set_proc(caps) == -1) {
        perror("cap_set_proc");
        cap_free(caps);
        return -1;
    }
    
    cap_free(caps);
    return 0;
}

int main() {
    printf("Time sync daemon starting...\n");
    
    // 시간 설정 (CAP_SYS_TIME 사용)
    time_t current_time = time(NULL);
    printf("Current time: %s", ctime(&current_time));
    
    // 예제: 1초 추가 (실제로는 NTP 서버에서 가져옴)
    if (set_system_time(current_time + 1) == 0) {
        printf("Time adjusted successfully\n");
    }
    
    // 작업 완료 후 모든 capabilities 제거
    printf("Dropping all capabilities...\n");
    if (drop_capabilities() == 0) {
        printf("Capabilities dropped successfully\n");
    }
    
    // 이제 일반 사용자 권한으로 계속 실행
    printf("Running with minimal privileges\n");
    
    return 0;
}

$ gcc -o time_sync time_sync.c -lcap
$ sudo setcap 'cap_sys_time=+ep' ./time_sync
$ ./time_sync  # root 권한 없이 실행!

# 기본적으로 모든 capability 제거하고 필요한 것만 추가
$ docker run --rm -it \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --cap-add=NET_RAW \
  ubuntu:latest /bin/bash

# 컨테이너 내부에서 확인
root@container:/# capsh --print

FROM ubuntu:20.04

RUN apt-get update && apt-get install -y \
    libcap2-bin \
    python3 \
    && rm -rf /var/lib/apt/lists/*

COPY myapp.py /app/myapp.py
RUN chmod +x /app/myapp.py

# Python에 capability 부여
RUN setcap 'cap_net_bind_service=+ep' /usr/bin/python3.8

USER nobody
WORKDIR /app

CMD ["python3", "myapp.py"]

version: '3.8'

services:
  webserver:
    image: mywebserver:latest
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    ports:
      - "80:80"
    user: "1000:1000"  # 비root 사용자로 실행
    security_opt:
      - no-new-privileges:true

$ sudo find / -type f -exec getcap {} \; 2>/dev/null

/usr/bin/ping = cap_net_raw+ep
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
...

$ grep Cap /proc/self/status

CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 000001ffffffffff
CapAmb: 0000000000000000

$ capsh --decode=000001ffffffffff

0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,...

# /etc/systemd/system/mywebserver.service

[Unit]
Description=My Web Server
After=network.target

[Service]
Type=simple
User=webuser
Group=webgroup

# 실행 파일
ExecStart=/usr/local/bin/mywebserver

# Capabilities 설정
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# 보안 강화 옵션
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/www

# 리소스 제한
LimitNOFILE=65536
LimitNPROC=512

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/netmonitor.service

[Unit]
Description=Network Monitoring Service
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
User=netmon
Group=netmon

ExecStart=/usr/local/bin/netmonitor --config /etc/netmonitor/config.yml

# 필요한 capabilities만 부여
AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN

# 강력한 보안 설정
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true

# 네트워크 네임스페이스는 공유 (모니터링 필요)
PrivateNetwork=false

# 로그 디렉토리만 쓰기 가능
ReadWritePaths=/var/log/netmonitor

# 시스템 콜 필터링 (화이트리스트 방식)
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources

# 재시작 정책
Restart=on-failure
RestartSec=10s

[Install]
WantedBy=multi-user.target

[Service]
# 네트워크 관련 시스템 콜만 허용
SystemCallFilter=@network-io @basic-io @file-system

# 또는 위험한 시스템 콜 차단
SystemCallFilter=~@privileged @resources @obsolete

# 특정 시스템 콜 명시적 차단
SystemCallFilter=~execve execveat

[Service]
# IPv4와 IPv6만 허용
RestrictAddressFamilies=AF_INET AF_INET6

# 또는 Unix 소켓만 허용
RestrictAddressFamilies=AF_UNIX

[Service]
# 시스템 디렉토리 보호
ProtectSystem=strict

# 특정 경로만 쓰기 허용
ReadWritePaths=/var/lib/myapp /var/log/myapp

# 특정 경로는 읽기만 허용
ReadOnlyPaths=/etc/myapp

# 특정 경로 완전 차단
InaccessiblePaths=/home /root

# 임시 디렉토리 격리
PrivateTmp=true

$ systemctl status mywebserver.service
$ systemctl show mywebserver.service | grep Cap

CapabilityBoundingSet=cap_net_bind_service
AmbientCapabilities=cap_net_bind_service

# 서비스의 메인 PID 찾기
$ systemctl show -p MainPID mywebserver.service
MainPID=1234

# 해당 프로세스의 capabilities 확인
$ grep Cap /proc/1234/status
$ cat /proc/1234/status | grep Cap

CapInh: 0000000000000400
CapPrm: 0000000000000400
CapEff: 0000000000000400
CapBnd: 0000000000000400
CapAmb: 0000000000000400

# 해석
$ capsh --decode=0000000000000400
0x0000000000000400=cap_net_bind_service

import prctl
import os

def drop_capabilities():
    """모든 capabilities 제거"""
    try:
        # Bounding set에서 모든 capabilities 제거
        for cap in range(prctl.CAP_LAST_CAP + 1):
            try:
                prctl.capbset_drop(cap)
            except OSError:
                pass  # 이미 없는 capability
        
        # Ambient capabilities 제거
        prctl.cap_ambient.clear()
        
        print("All capabilities dropped successfully")
    except Exception as e:
        print(f"Error dropping capabilities: {e}")

def keep_only_net_bind():
    """CAP_NET_BIND_SERVICE만 유지"""
    import prctl
    
    # 필요한 capability 설정
    prctl.cap_effective.net_bind_service = True
    prctl.cap_permitted.net_bind_service = True
    prctl.cap_inheritable.net_bind_service = True
    
    # Ambient에 추가 (선택사항)
    prctl.cap_ambient.net_bind_service = True
    
    print(f"Current capabilities: {prctl.cap_effective}")

def check_capability(cap_name):
    """특정 capability 확인"""
    import prctl
    
    cap = getattr(prctl.CAP, cap_name.upper())
    has_cap = prctl.capbset_read(cap)
    
    print(f"Has {cap_name}: {has_cap}")
    return has_cap

if __name__ == '__main__':
    print("Initial capabilities:")
    print(f"Effective: {prctl.cap_effective}")
    print(f"Permitted: {prctl.cap_permitted}")
    
    # CAP_NET_BIND_SERVICE 확인
    if check_capability('net_bind_service'):
        # 80번 포트 바인딩 시도
        import socket
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        try:
            sock.bind(('0.0.0.0', 80))
            print("Successfully bound to port 80!")
            sock.close()
        except PermissionError:
            print("Failed to bind to port 80")
    
    # 권한 제거
    drop_capabilities()

$ pip install python-prctl

import com.sun.jna.Library;
import com.sun.jna.Native;
import com.sun.jna.Pointer;

public class CapabilityManager {
    
    // libcap 라이브러리 인터페이스
    public interface LibCap extends Library {
        LibCap INSTANCE = Native.load("cap", LibCap.class);
        
        Pointer cap_get_proc();
        int cap_set_proc(Pointer cap);
        Pointer cap_from_text(String text);
        String cap_to_text(Pointer cap, Pointer len);
        int cap_free(Pointer cap);
    }
    
    public static void printCurrentCapabilities() {
        Pointer caps = LibCap.INSTANCE.cap_get_proc();
        if (caps == null) {
            System.err.println("Failed to get capabilities");
            return;
        }
        
        String capsText = LibCap.INSTANCE.cap_to_text(caps, null);
        System.out.println("Current capabilities: " + capsText);
        
        LibCap.INSTANCE.cap_free(caps);
    }
    
    public static boolean setCapabilities(String capText) {
        Pointer caps = LibCap.INSTANCE.cap_from_text(capText);
        if (caps == null) {
            System.err.println("Invalid capability text: " + capText);
            return false;
        }
        
        int result = LibCap.INSTANCE.cap_set_proc(caps);
        LibCap.INSTANCE.cap_free(caps);
        
        return result == 0;
    }
    
    public static void dropAllCapabilities() {
        setCapabilities("=");  // 빈 세트
        System.out.println("All capabilities dropped");
    }
    
    public static void main(String[] args) {
        System.out.println("=== Java Capability Manager ===");
        
        printCurrentCapabilities();
        
        // CAP_NET_BIND_SERVICE만 유지
        if (setCapabilities("cap_net_bind_service=ep")) {
            System.out.println("Successfully set CAP_NET_BIND_SERVICE");
            printCurrentCapabilities();
        }
        
        // 모든 capabilities 제거
        dropAllCapabilities();
        printCurrentCapabilities();
    }
}

<dependency>
    <groupId>net.java.dev.jna</groupId>
    <artifactId>jna</artifactId>
    <version>5.12.1</version>
</dependency>

use caps::{Capability, CapSet, CapsHashSet};
use std::error::Error;

fn print_capabilities() -> Result<(), Box<dyn Error>> {
    println!("Current capabilities:");
    
    for set in &[CapSet::Effective, CapSet::Permitted, CapSet::Inheritable] {
        let caps = caps::read(None, *set)?;
        println!("  {:?}: {:?}", set, caps);
    }
    
    Ok(())
}

fn drop_all_capabilities() -> Result<(), Box<dyn Error>> {
    let empty = CapsHashSet::new();
    
    caps::set(None, CapSet::Effective, &empty)?;
    caps::set(None, CapSet::Permitted, &empty)?;
    caps::set(None, CapSet::Inheritable, &empty)?;
    
    println!("All capabilities dropped");
    Ok(())
}

fn keep_only_net_bind() -> Result<(), Box<dyn Error>> {
    let mut caps = CapsHashSet::new();
    caps.insert(Capability::CAP_NET_BIND_SERVICE);
    
    caps::set(None, CapSet::Effective, &caps)?;
    caps::set(None, CapSet::Permitted, &caps)?;
    
    println!("Kept only CAP_NET_BIND_SERVICE");
    Ok(())
}

fn has_capability(cap: Capability) -> Result<bool, Box<dyn Error>> {
    let caps = caps::read(None, CapSet::Effective)?;
    Ok(caps.contains(&cap))
}

fn main() -> Result<(), Box<dyn Error>> {
    println!("=== Rust Capability Manager ===\n");
    
    print_capabilities()?;
    
    if has_capability(Capability::CAP_NET_BIND_SERVICE)? {
        println!("\nHas CAP_NET_BIND_SERVICE - can bind to port 80");
    }
    
    println!("\nKeeping only CAP_NET_BIND_SERVICE...");
    keep_only_net_bind()?;
    print_capabilities()?;
    
    println!("\nDropping all capabilities...");
    drop_all_capabilities()?;
    print_capabilities()?;
    
    Ok(())
}

[dependencies]
caps = "0.5"

const cap = require('cap');
const http = require('http');

// 현재 capabilities 확인
function printCapabilities() {
    try {
        const caps = cap.getCapabilities();
        console.log('Current capabilities:', caps);
    } catch (err) {
        console.error('Failed to get capabilities:', err.message);
    }
}

// 특정 capability 확인
function hasCapability(capName) {
    try {
        return cap.hasCapability(capName);
    } catch (err) {
        return false;
    }
}

// Capabilities 설정
function setCapabilities(capList) {
    try {
        cap.setCapabilities(capList);
        console.log('Capabilities set successfully');
        return true;
    } catch (err) {
        console.error('Failed to set capabilities:', err.message);
        return false;
    }
}

// 메인 로직
console.log('=== Node.js Capability Manager ===\n');

printCapabilities();

if (hasCapability('cap_net_bind_service')) {
    console.log('\nHas CAP_NET_BIND_SERVICE - starting server on port 80');
    
    const server = http.createServer((req, res) => {
        res.writeHead(200, {'Content-Type': 'text/plain'});
        res.end('Hello from port 80 without root!\n');
    });
    
    server.listen(80, () => {
        console.log('Server running on port 80');
        
        // 서버 시작 후 capabilities 제거
        console.log('\nDropping capabilities after binding...');
        setCapabilities([]);  // 모두 제거
        printCapabilities();
        
        // nobody 사용자로 전환
        try {
            process.setgid('nobody');
            process.setuid('nobody');
            console.log('Switched to nobody user');
        } catch (err) {
            console.error('Failed to switch user:', err.message);
        }
    });
} else {
    console.log('\nNo CAP_NET_BIND_SERVICE - cannot bind to port 80');
}

$ npm install cap

#!/bin/bash
# cap_debug.sh - Capability 디버깅 스크립트

echo "=== Capability Debug Information ==="
echo

# 현재 프로세스 정보
echo "Current Process (PID: $$):"
grep Cap /proc/$$/status | while read line; do
    cap_name=$(echo $line | cut -d: -f1)
    cap_hex=$(echo $line | cut -d: -f2 | tr -d ' ')
    cap_decoded=$(capsh --decode=$cap_hex 2>/dev/null)
    echo "  $cap_name: $cap_hex"
    echo "    → $cap_decoded"
done

echo
echo "Bounding Set:"
cat /proc/$$/status | grep CapBnd | cut -d: -f2 | tr -d ' ' | \
    xargs -I {} capsh --decode={}

echo
echo "Ambient Set:"
cat /proc/$$/status | grep CapAmb | cut -d: -f2 | tr -d ' ' | \
    xargs -I {} capsh --decode={}

# 실행 파일 정보
if [ -n "$1" ]; then
    echo
    echo "File Capabilities for: $1"
    getcap "$1"
fi

# Securebits 정보
echo
echo "Securebits:"
grep Seccomp /proc/$$/status

$ chmod +x cap_debug.sh
$ ./cap_debug.sh /path/to/myapp

# Capability 관련 시스템 콜 추적
$ strace -e trace=capget,capset,prctl ./myapp

# 실패한 시스템 콜만 표시
$ strace -e trace=capget,capset,prctl -Z ./myapp 2>&1 | grep -i "operation not permitted"

# 더 상세한 정보
$ strace -f -e trace=capget,capset,prctl -s 1000 ./myapp

#include <stdio.h>
#include <sys/capability.h>
#include <sys/prctl.h>
#include <errno.h>
#include <string.h>

void print_cap_set(const char *name, cap_flag_t flag) {
    cap_t caps = cap_get_proc();
    if (!caps) {
        perror("cap_get_proc");
        return;
    }
    
    printf("%s capabilities:\n", name);
    
    for (int i = 0; i <= CAP_LAST_CAP; i++) {
        cap_flag_value_t value;
        if (cap_get_flag(caps, i, flag, &value) == 0 && value == CAP_SET) {
            char *cap_name = cap_to_name(i);
            printf("  %s\n", cap_name);
            cap_free(cap_name);
        }
    }
    
    cap_free(caps);
}

int test_capability(cap_value_t cap) {
    cap_t caps = cap_get_proc();
    if (!caps) return -1;
    
    cap_flag_value_t value;
    int result = cap_get_flag(caps, cap, CAP_EFFECTIVE, &value);
    
    cap_free(caps);
    
    return (result == 0 && value == CAP_SET) ? 1 : 0;
}

int main() {
    printf("=== Capability Test Program ===\n\n");
    
    print_cap_set("Effective", CAP_EFFECTIVE);
    printf("\n");
    print_cap_set("Permitted", CAP_PERMITTED);
    printf("\n");
    print_cap_set("Inheritable", CAP_INHERITABLE);
    printf("\n");
    
    // 특정 capabilities 테스트
    printf("Specific capability tests:\n");
    
    const char *test_caps[] = {
        "CAP_NET_BIND_SERVICE",
        "CAP_NET_RAW",
        "CAP_SYS_ADMIN",
        "CAP_SETUID",
        NULL
    };
    
    for (int i = 0; test_caps[i]; i++) {
        cap_value_t cap;
        if (cap_from_name(test_caps[i], &cap) == 0) {
            int has_cap = test_capability(cap);
            printf("  %s: %s\n", test_caps[i], 
                   has_cap ? "YES ✓" : "NO ✗");
        }
    }
    
    // Securebits 확인
    printf("\nSecurebits: 0x%x\n", prctl(PR_GET_SECUREBITS));
    
    // No new privileges 확인
    printf("No new privileges: %s\n", 
           prctl(PR_GET_NO_NEW_PRIVS) ? "YES" : "NO");
    
    return 0;
}

$ gcc -o captest captest.c -lcap
$ ./captest

#!/bin/bash
# cap_benchmark.sh

echo "=== Capability Performance Benchmark ==="

# 테스트 프로그램 (간단한 네트워크 바인딩)
cat > test_bind.c <<'EOF'
#include <sys/socket.h>
#include <netinet/in.h>
#include <stdio.h>
#include <unistd.h>

int main() {
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_port = htons(8080),
        .sin_addr.s_addr = INADDR_ANY
    };
    
    bind(sock, (struct sockaddr*)&addr, sizeof(addr));
    close(sock);
    return 0;
}
EOF

gcc -o test_bind test_bind.c

# 1. Root로 실행
echo "Test 1: Running as root"
sudo time -p bash -c 'for i in {1..1000}; do ./test_bind; done'

# 2. Capability로 실행
echo -e "\nTest 2: Running with CAP_NET_BIND_SERVICE"
sudo setcap 'cap_net_bind_service=+ep' ./test_bind
time -p bash -c 'for i in {1..1000}; do ./test_bind; done'

# 3. Setuid로 실행
echo -e "\nTest 3: Running with setuid"
sudo chown root:root ./test_bind
sudo chmod u+s ./test_bind
time -p bash -c 'for i in {1..1000}; do ./test_bind; done'

# 정리
sudo setcap -r ./test_bind
sudo chmod u-s ./test_bind
rm test_bind test_bind.c

// secure_server.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <sys/capability.h>
#include <sys/prctl.h>
#include <pwd.h>
#include <grp.h>
#include <syslog.h>
#include <signal.h>

#define PORT 80
#define BACKLOG 128
#define BUFFER_SIZE 4096

volatile sig_atomic_t running = 1;

void signal_handler(int sig) {
    running = 0;
}

int drop_capabilities() {
    cap_t caps = cap_init();
    if (!caps) {
        syslog(LOG_ERR, "cap_init failed");
        return -1;
    }
    
    if (cap_set_proc(caps) == -1) {
        syslog(LOG_ERR, "cap_set_proc failed");
        cap_free(caps);
        return -1;
    }
    
    cap_free(caps);
    syslog(LOG_INFO, "All capabilities dropped");
    return 0;
}

int drop_privileges(const char *username) {
    struct passwd *pw = getpwnam(username);
    if (!pw) {
        syslog(LOG_ERR, "User %s not found", username);
        return -1;
    }
    
    // 보조 그룹 설정
    if (initgroups(username, pw->pw_gid) == -1) {
        syslog(LOG_ERR, "initgroups failed");
        return -1;
    }
    
    // GID 변경
    if (setgid(pw->pw_gid) == -1) {
        syslog(LOG_ERR, "setgid failed");
        return -1;
    }
    
    // UID 변경
    if (setuid(pw->pw_uid) == -1) {
        syslog(LOG_ERR, "setuid failed");
        return -1;
    }
    
    // 권한 상승 방지
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
        syslog(LOG_ERR, "prctl(PR_SET_NO_NEW_PRIVS) failed");
        return -1;
    }
    
    syslog(LOG_INFO, "Dropped privileges to user %s (uid=%d, gid=%d)", 
           username, pw->pw_uid, pw->pw_gid);
    return 0;
}

int create_server_socket() {
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    if (sock == -1) {
        syslog(LOG_ERR, "socket() failed");
        return -1;
    }
    
    // SO_REUSEADDR 설정
    int opt = 1;
    if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)) == -1) {
        syslog(LOG_WARNING, "setsockopt(SO_REUSEADDR) failed");
    }
    
    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_port = htons(PORT),
        .sin_addr.s_addr = INADDR_ANY
    };
    
    // 바인딩 (CAP_NET_BIND_SERVICE 필요)
    if (bind(sock, (struct sockaddr*)&addr, sizeof(addr)) == -1) {
        syslog(LOG_ERR, "bind() failed on port %d", PORT);
        close(sock);
        return -1;
    }
    
    if (listen(sock, BACKLOG) == -1) {
        syslog(LOG_ERR, "listen() failed");
        close(sock);
        return -1;
    }
    
    syslog(LOG_INFO, "Server listening on port %d", PORT);
    return sock;
}

void handle_client(int client_sock) {
    char buffer[BUFFER_SIZE];
    ssize_t bytes_read = recv(client_sock, buffer, sizeof(buffer) - 1, 0);
    
    if (bytes_read > 0) {
        buffer[bytes_read] = '\0';
        
        // 간단한 HTTP 응답
        const char *response = 
            "HTTP/1.1 200 OK\r\n"
            "Content-Type: text/html\r\n"
            "Connection: close\r\n"
            "\r\n"
            "<html><body>"
            "<h1>Secure Server</h1>"
            "<p>Running without root privileges!</p>"
            "</body></html>";
        
        send(client_sock, response, strlen(response), 0);
    }
    
    close(client_sock);
}

int main(int argc, char *argv[]) {
    const char *username = "nobody";
    
    if (argc > 1) {
        username = argv[1];
    }
    
    // Syslog 초기화
    openlog("secure_server", LOG_PID | LOG_CONS, LOG_DAEMON);
    
    syslog(LOG_INFO, "Starting secure server...");
    
    // 시그널 핸들러 설정
    signal(SIGINT, signal_handler);
    signal(SIGTERM, signal_handler);
    
    // 서버 소켓 생성 (CAP_NET_BIND_SERVICE 사용)
    int server_sock = create_server_socket();
    if (server_sock == -1) {
        syslog(LOG_ERR, "Failed to create server socket");
        return 1;
    }
    
    // 권한 제거 (순서 중요!)
    // 1. 먼저 사용자 변경
    if (drop_privileges(username) == -1) {
        close(server_sock);
        return 1;
    }
    
    // 2. 그 다음 capabilities 제거
    if (drop_capabilities() == -1) {
        close(server_sock);
        return 1;
    }
    
    syslog(LOG_INFO, "Server started successfully with minimal privileges");
    
    // 메인 루프
    while (running) {
        struct sockaddr_in client_addr;
        socklen_t client_len = sizeof(client_addr);
        
        int client_sock = accept(server_sock, 
                                (struct sockaddr*)&client_addr, 
                                &client_len);
        
        if (client_sock == -1) {
            if (running) {
                syslog(LOG_WARNING, "accept() failed");
            }
            continue;
        }
        
        handle_client(client_sock);
    }
    
    close(server_sock);
    syslog(LOG_INFO, "Server stopped");
    closelog();
    
    return 0;
}

$ gcc -o secure_server secure_server.c -lcap
$ sudo setcap 'cap_net_bind_service=+ep' ./secure_server

# /etc/systemd/system/secure-server.service

[Unit]
Description=Secure HTTP Server
After=network-online.target
Wants=network-online.target
Documentation=https://www.jaenung.net

[Service]
Type=simple
User=nobody
Group=nogroup

# 실행 파일
ExecStart=/usr/local/bin/secure_server

# Capabilities 설정
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# 보안 강화
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallArchitectures=native

# 시스템 콜 필터
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources @obsolete

# 파일 시스템 접근
ReadWritePaths=/var/log/secure-server

# 리소스 제한
LimitNOFILE=65536
LimitNPROC=512
TasksMax=256

# 재시작 정책
Restart=on-failure
RestartSec=10s
StartLimitBurst=5
StartLimitIntervalSec=60s

# 로깅
StandardOutput=journal
StandardError=journal
SyslogIdentifier=secure-server

[Install]
WantedBy=multi-user.target

$ sudo cp secure_server /usr/local/bin/
$ sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/secure_server
$ sudo systemctl daemon-reload
$ sudo systemctl enable secure-server
$ sudo systemctl start secure-server
$ sudo systemctl status secure-server

#!/bin/bash
# monitor_server.sh

echo "=== Secure Server Monitoring ==="
echo

# 서비스 상태
echo "Service Status:"
systemctl status secure-server --no-pager | head -n 10
echo

# 프로세스 정보
PID=$(systemctl show -p MainPID secure-server | cut -d= -f2)

if [ "$PID" != "0" ]; then
    echo "Process Information (PID: $PID):"
    echo "  User: $(ps -o user= -p $PID)"
    echo "  Command: $(ps -o cmd= -p $PID)"
    echo
    
    # Capabilities
    echo "Capabilities:"
    grep Cap /proc/$PID/status | while read line; do
        cap_name=$(echo $line | cut -d: -f1)
        cap_hex=$(echo $line | cut -d: -f2 | tr -d ' ')
        echo "  $cap_name: $cap_hex"
        if [ "$cap_hex" != "0000000000000000" ]; then
            capsh --decode=$cap_hex 2>/dev/null | sed 's/^/    /'
        fi
    done
    echo
    
    # 네트워크 연결
    echo "Network Connections:"
    ss -tlnp | grep $PID
    echo
    
    # 리소스 사용량
    echo "Resource Usage:"
    echo "  Memory: $(ps -o rss= -p $PID | awk '{print $1/1024 " MB"}')"
    echo "  CPU: $(ps -o %cpu= -p $PID)%"
    echo
    
    # 파일 디스크립터
    echo "Open File Descriptors: $(ls /proc/$PID/fd | wc -l)"
    echo
fi

# 최근 로그
echo "Recent Logs:"
journalctl -u secure-server -n 10 --no-pager

# 보안 점수
echo
echo "Security Score:"
systemd-analyze security secure-server 2>/dev/null | head -n 5

$ chmod +x monitor_server.sh
$ ./monitor_server.sh

// 좋은 예
cap_t caps = cap_from_text("cap_net_bind_service=ep");
cap_set_proc(caps);
// 포트 바인딩
bind(sock, ...);
// 즉시 제거
cap_from_text("=");
cap_set_proc(caps);

if (cap_set_proc(caps) == -1) {
    syslog(LOG_ERR, "Failed to set capabilities: %s", strerror(errno));
    // 안전하게 종료
    exit(1);
}

// 설정 확인
cap_t current = cap_get_proc();
char *text = cap_to_text(current, NULL);
syslog(LOG_INFO, "Current capabilities: %s", text);
cap_free(text);
cap_free(current);

// 1. 포트 바인딩
bind(sock, ...);

// 2. Bounding set 제한
for (int i = 0; i <= CAP_LAST_CAP; i++) {
    prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
}

// 3. 사용자 변경
setuid(nobody_uid);

// 4. Capabilities 제거
cap_t empty = cap_init();
cap_set_proc(empty);
cap_free(empty);

// 5. No new privileges
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);

// 6. Seccomp (선택사항)
// install_seccomp_filter();

#!/bin/bash
# test_capabilities.sh

echo "Testing capability requirements..."

# 각 capability를 하나씩 제거하며 테스트
for cap in net_bind_service net_raw sys_admin; do
    echo "Testing without CAP_${cap^^}..."
    
    # Capability 제거
    sudo setcap -r ./myapp
    sudo setcap "cap_net_bind_service,cap_net_raw,cap_sys_admin-cap_$cap=ep" ./myapp
    
    # 테스트 실행
    if ./myapp --test; then
        echo "  ✓ Works without CAP_${cap^^}"
    else
        echo "  ✗ Requires CAP_${cap^^}"
    fi
done

## Security Configuration

This application requires the following capabilities:

- **CAP_NET_BIND_SERVICE**: Required to bind to port 80
  - Used in: src/server.c:123
  - Alternative: Run on port 8080 and use reverse proxy
  
- **CAP_NET_RAW**: Required for ICMP ping functionality
  - Used in: src/monitor.c:456
  - Can be disabled with --no-ping flag

### Installation

```bash
sudo setcap 'cap_net_bind_service,cap_net_raw=+ep' ./myapp
```

### Verification

```bash
getcap ./myapp
# Expected: cap_net_bind_service,cap_net_raw=ep
```

#!/bin/bash
# audit_capabilities.sh

echo "=== Capability Audit Report ==="
echo "Date: $(date)"
echo

echo "Files with capabilities:"
sudo find / -type f -exec getcap {} \; 2>/dev/null | \
    while read line; do
        file=$(echo $line | cut -d' ' -f1)
        caps=$(echo $line | cut -d'=' -f2-)
        
        echo "File: $file"
        echo "  Capabilities: $caps"
        echo "  Owner: $(ls -l $file | awk '{print $3":"$4}')"
        echo "  Modified: $(stat -c %y $file)"
        echo
    done

echo "Running processes with capabilities:"
for pid in /proc/[0-9]*; do
    caps=$(grep CapEff $pid/status 2>/dev/null | awk '{print $2}')
    if [ "$caps" != "0000000000000000" ]; then
        cmd=$(cat $pid/cmdline 2>/dev/null | tr '\0' ' ')
        echo "PID: $(basename $pid)"
        echo "  Command: $cmd"
        echo "  Capabilities: $(capsh --decode=$caps)"
        echo
    fi
done