capable(8)

✨ capable(8) ✨

System Manager's Manual 💖 Manual name: capable(8)

🎀 NAME 🎀

capable, trace security capability checks (cap_capable()) 👀✨

💅 SYNOPSIS 💅

capable [-h] [-v] [-p PID] [-K] [-U] [-x] [--cgroupmap MAPPATH]
                  [--mntnsmap MAPPATH] [--unique]

📖 DESCRIPTION 📖

okay so this one traces security capability checks in the kernel and prints details for every single call 😭 it's giving detective energy. It's super useful for general debugging, and also for security enforcement, like figuring out a white list of capabilities an application actually needs 🔥

Since this uses BPF, only the root user can use this tool 👑 no cap, not everyone gets to run it.

🧰 REQUIREMENTS 🧰

CONFIG_BPF, bcc. 🌸

🎛️ OPTIONS 🎛️

• -h — the main character move here: prints the USAGE message 📣
• -v — include non-audit capability checks too 👀 these are the ones deemed not interesting and not necessary to audit, like CAP_SYS_ADMIN checks on memory allocation that affect overcommit behavior 🙈
• -K — adds kernel stack traces to the output 🧚
• -U — adds user-space stack traces to the output 🦋
• -x — shows extra fields in the TID and INSETID columns ✨
• --cgroupmap MAPPATH — only traces cgroups in this BPF map (filtered in-kernel) 💜
• --mntnsmap MAPPATH — only traces mount namespaces in this BPF map (filtered in-kernel) 🌈
• --unique — don't repeat stacks for the same PID or cgroup 💅

🌟 EXAMPLES 🌟

Trace all capability checks system-wide:

# capable

Trace capability checks for PID 181:

# capable -p 181

Trace capability checks in a set of cgroups only (see special_filtering.md from bcc sources for more details):

# capable --cgroupmap /sys/fs/bpf/test01

🔍 FIELDS 🔍

• TIME(s) — time of the capability check, in HH:MM:SS format ⏰
• UID — user ID 🫶
• PID — process ID 🍓
• COMM — process name 🎀
• CAP — capability number 🔢
• NAME — capability name. See capabilities(7) for descriptions 📚
• AUDIT — whether this was an audit event. Use -v to include non-audit events 🙈
• INSETID — whether the INSETID bit was set (Linux >= 5.1) 🦄

⚠️ OVERHEAD ⚠️

This adds low-overhead instrumentation to capability checks. They're expected to be low frequency, but that really depends on the application, so bestie, test in a lab environment before use 🥺

Heads up: the overhead depends on your application, so test in a lab environment before using this anywhere real 💀

🌈 SOURCE 🌈

This is from bcc 🫶

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file with example usage, output, and commentary for this tool 📖✨

🐧 OS 🐧

Linux 🐧

🧪 STABILITY 🧪

Unstable, still in development 🚧

👩‍💻 AUTHOR 👩‍💻

Brendan Gregg 👑

🔗 SEE ALSO 🔗

capabilities(7) 💖

---

Bye bestie, you're officially a capable(8) expert now 🎀 This page came from the USER COMMANDS section, sourced from bcc and dated 2020-03-08 📅💜