Linux Kernel Capabilities & Bounding Sets

Configuring fine-grained kernel privileges with getcap and setcap, dropping dangerous capabilities from service units.

Demonstrable Learning Objectives (2)

1

SEC-LINUX-OBJ-005

Inspect granular Linux kernel capabilities (CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN) with getcap/setcap.

2

SEC-LINUX-OBJ-006

Drop ambient and inheritable capability sets in systemd service definitions to enforce least privilege.

Technical Workbooks (1)

Practice Assessments (1)

Curriculum Lessons (1)