capable.bt(8)

📦 version 0.17.0, in debian bookworm

💖 capable.bt — ok so here's the tea 💖

bestie. this is capable.bt(8), from the System Manager's Manual, and it's giving "I can see everything the kernel is checking" energy. buckle up 🎀

✨ NAME ✨

capable.bt — trace security capability checks (aka cap_capable()). that's it. that's the whole job. 💅

🌸 SYNOPSIS 🌸

capable.bt

literally just run it. no args, no drama, no flags. iconic. ✨

🦋 DESCRIPTION 🦋

okay so here's what's happening: this thing traces security capability checks inside the kernel, and prints the deets for every single call. 🫶

why do you care? two reasons, bestie:

  • general debugging — you know, the usual detective work 🔍
  • security enforcement — you can use it to figure out a white list of capabilities that an application actually needs 👑

and the big caveat, no cap: since this uses BPF, only the root user can run this tool. sorry babe, that's just how it is. 🙈

💜 REQUIREMENTS 💜

  • CONFIG_BPF
  • bpftrace

that's the whole guest list. 🎀

🔥 EXAMPLES 🔥

trace all capability checks system-wide:

# capable.bt

one line. one command. main character energy. 😌

👑 FIELDS 👑

here's what each column is serving:

  • TIME(s) — time of the capability check, formatted HH:MM:SS. ⏰
  • UID — user ID. who dis. 🪪
  • PID — process ID. 🏷️
  • COMM — process name. 💬
  • CAP — capability number. 🔢
  • NAME — capability name. for the descriptions, go peek at capabilities(7). 📖
  • AUDIT — whether this was an audit event. 👀

🌈 OVERHEAD 🌈

okay so this adds low-overhead instrumentation to capability checks — and capability checks are expected to be low frequency, so like, usually fine?? but lowkey that totally depends on the application, so don't come for me. 😭

⚠️ test in a lab environment before use. fr fr. do not skip this step bestie. 🚨

🍓 SOURCE 🍓

this is from bpftrace.

https://github.com/iovisor/bpftrace

also, go look inside the bpftrace distribution for a companion _examples.txt file — it's got example usage, output, and commentary for this tool. it's a whole vibe. 💖

this is a bpftrace version of the bcc tool of the same name. (the bcc tool has options to customize the output, if you're into that.) 🎀

https://github.com/iovisor/bcc

💅 OS 💅

Linux 🐧

⭐ STABILITY ⭐

Unstable — in development. she's a work in progress, and that's okay. 🧚

💜 AUTHOR 💜

Brendan Gregg 👑

🫶 SEE ALSO 🫶

and that's the whole page, bestie!! 💖 this was USER COMMANDS, version dated 2018-09-08, living its life as capable.bt(8). go trace some capabilities. slay. ✨💅🌈

📦 where this page comes from