https://www.scrivano.org/tags/capabilities/ Recent content in Capabilities on *scratch* Hugo en Thu, 24 Sep 2026 19:18:55 +0200 https://www.scrivano.org/posts/2026-09-24-cap-sys-ptrace-is-worse-than-cap-sys-admin/ Thu, 24 Sep 2026 10:00:00 +0200 https://www.scrivano.org/posts/2026-09-24-cap-sys-ptrace-is-worse-than-cap-sys-admin/ <p>I spend a lot of time working on crun and on how containers are kept separated from the host. Capabilities are one of the tools we use for that: instead of giving a container the full power of root, we hand out only the small pieces it needs. <code>CAP_SYS_ADMIN</code> gets most of the attention, since it is so powerful that people call it the new root, and dropping it is often treated as enough to make a container safe. I want to look at another capability that doesn&rsquo;t sound so dangerous: <code>CAP_SYS_PTRACE</code>.</p>