Setting POSIX Capabilities¶
POSIX capabilities allow fine-grained permissions for processes. In addition to the standard UNIX permission scheme, they define a new set of privileges for system resources. To enable capabilities support (Linux Only) you have to install the libcap headers (libcap-dev on Debian-based distros) before building uWSGI. As usual your processes will lose practically all of the capabilities after a setuid call. The uWSGI cap option allows you to define a list of capabilities to maintain through the call.
For example, to allow your unprivileged app to bind on privileged ports and set the system clock, you will use the following options.
uwsgi --socket :1000 --uid 5000 --gid 5000 --cap net_bind_service,sys_time
All of the processes generated by uWSGI will then inherit this behaviour. If your system supports capabailities not available in the uWSGI list you can simply specify the number of the constant:
uwsgi --socket :1000 --uid 5000 --gid 5000 --cap net_bind_service,sys_time,42
In addition to net_bind_service and sys_time, a new capability numbered ‘42’ is added.
Available capabilities¶
This is the list of available capabilities.
audit_control | CAP_AUDIT_CONTROL |
audit_write | CAP_AUDIT_WRITE |
chown | CAP_CHOWN |
dac_override | CAP_DAC_OVERRIDE |
dac_read_search | CAP_DAC_READ_SEARCH |
fowner | CAP_FOWNER |
fsetid | CAP_FSETID |
ipc_lock | CAP_IPC_LOCK |
ipc_owner | CAP_IPC_OWNER |
kill | CAP_KILL |
lease | CAP_LEASE |
linux_immutable | CAP_LINUX_IMMUTABLE |
mac_admin | CAP_MAC_ADMIN |
mac_override | CAP_MAC_OVERRIDE |
mknod | CAP_MKNOD |
net_admin | CAP_NET_ADMIN |
net_bind_service | CAP_NET_BIND_SERVICE |
net_broadcast | CAP_NET_BROADCAST |
net_raw | CAP_NET_RAW |
setfcap | CAP_SETFCAP |
setgid | CAP_SETGID |
setpcap | CAP_SETPCAP |
setuid | CAP_SETUID |
sys_admin | CAP_SYS_ADMIN |
sys_boot | CAP_SYS_BOOT |
sys_chroot | CAP_SYS_CHROOT |
sys_module | CAP_SYS_MODULE |
sys_nice | CAP_SYS_NICE |
sys_pacct | CAP_SYS_PACCT |
sys_ptrace | CAP_SYS_PTRACE |
sys_rawio | CAP_SYS_RAWIO |
sys_resource | CAP_SYS_RESOURCE |
sys_time | CAP_SYS_TIME |
sys_tty_config | CAP_SYS_TTY_CONFIG |
syslog | CAP_SYSLOG |
wake_alarm | CAP_WAKE_ALARM |