A county Linux host shows file capability bits granting a binary powerful privileges without a traditional SUID bit. What should the tester include in enumeration thinking?
Select an answer to reveal the explanation.
Short Explanation
Think of capabilities as giving someone a master key to one wing of the building instead of the whole campus. A binary can get dangerous rights without looking like classic SUID. Good Linux priv-esc enum checks capabilities alongside the usual suspects.
Full Explanation
When a county Linux host shows file capability bits granting a binary powerful privileges without a traditional SUID bit, enumeration must include those capabilities: they can confer selective but powerful rights (network, ptrace-adjacent themes, file influence) and deserve attention comparable to SUID findings.
Capabilities are not Windows-only. A capability bit does not automatically mean the binary is safely sandboxed against privilege escalation. Capability listings do not replace review of sudoers, cron, and writable paths—they are additive.
Exam caveat: getcap/file capability review pairs with process capability inspection for running services.
Operational check: inventory file capabilities on civic binaries, flag overly broad sets on user-reachable tools, and recommend dropping unnecessary capabilities. Document how the capability set could change privilege boundaries for county operators. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.