# Show capabilities of current process
capsh --print

# Show capabilities of a running process
cat /proc/<pid>/status | grep Cap
capsh --decode=$(cat /proc/<pid>/status | grep CapEff | awk '{print $2}')

# Set file capabilities (no setuid needed)
setcap cap_net_bind_service+ep /usr/bin/node
getcap /usr/bin/node

# Remove file capabilities
setcap -r /usr/bin/node

# Drop capabilities in systemd service
# [Service]
# CapabilityBoundingSet=CAP_NET_BIND_SERVICE
# AmbientCapabilities=CAP_NET_BIND_SERVICE
# NoNewPrivileges=yes

# Check if a process has a seccomp filter
cat /proc/<pid>/status | grep Seccomp
# 0=disabled, 1=strict, 2=filter

# Docker default seccomp profile (allows ~300 of ~400 syscalls)
docker run --security-opt seccomp=/path/to/profile.json myimage

# Disable seccomp (e.g. for debugging — not for production)
docker run --security-opt seccomp=unconfined myimage

# systemd service seccomp filter
# [Service]
# SystemCallFilter=@system-service    # predefined set
# SystemCallFilter=~@privileged       # deny privileged calls
# SystemCallErrorNumber=EPERM         # return EPERM instead of kill

# List systemd syscall groups
systemd-analyze syscall-filter

# Check AppArmor status
aa-status
apparmor_status

# Set a profile to complain mode (for learning)
aa-complain /etc/apparmor.d/usr.sbin.nginx

# Set back to enforce
aa-enforce /etc/apparmor.d/usr.sbin.nginx

# Reload a profile
apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx

# Generate a profile from scratch (interactive)
aa-genprof /usr/bin/myapp
# run the app in another terminal, then press S to scan logs

# Check violation logs
journalctl -k | grep apparmor
grep DENIED /var/log/syslog

/usr/bin/myapp {
  #include <abstractions/base>

  /etc/myapp/**  r,          # read config
  /var/lib/myapp/** rw,      # read-write data dir
  /var/log/myapp/*.log w,    # write logs
  /tmp/myapp-*   rw,

  network tcp,               # allow TCP
  capability net_bind_service,

  deny /etc/shadow r,        # explicit deny
}

# Show SELinux status and mode
getenforce              # Enforcing | Permissive | Disabled
sestatus

# View process contexts
ps -eZ | grep nginx     # system_u:system_r:httpd_t:s0

# View file contexts
ls -Z /var/www/html/
stat -c '%C' /var/www/html/index.html

# Temporarily switch mode (not persistent)
setenforce 0            # Permissive (log but don't block)
setenforce 1            # Enforcing

# Persistent mode (requires reboot)
# Edit /etc/selinux/config: SELINUX=permissive

# Fix file context (relabel to match policy)
restorecon -Rv /var/www/html/
chcon -t httpd_sys_content_t /srv/mysite/index.html

# Check what's being denied
ausearch -m avc -ts recent
journalctl | grep avc

# Generate policy module from denials (audit2allow)
ausearch -m avc -ts recent | audit2allow -M mymodule
semodule -i mymodule.pp

# List and toggle booleans
getsebool -a | grep httpd
setsebool -P httpd_can_network_connect on  # -P = persistent

# Allow nginx to connect to upstream (common fix)
setsebool -P httpd_can_network_connect 1

# List namespaces of a process
ls -la /proc/<pid>/ns/

# Enter another process's namespace
nsenter -t <pid> --net --pid -- bash
nsenter -t <pid> --all -- bash   # all namespaces

# Create a new network namespace
ip netns add myns
ip netns exec myns ip link list
ip netns del myns

# Run a process in new namespaces (like a mini-container)
unshare --pid --fork --mount-proc bash

# List all network namespaces
ip netns list
lsns --type net

# Permission bits: rwxrwxrwx = user|group|other
chmod 644 file          # rw-r--r--
chmod 755 dir           # rwxr-xr-x
chmod u+x,g-w file      # symbolic
chmod -R 750 /dir       # recursive

# Special bits
chmod u+s /usr/bin/passwd   # setuid: runs as file owner
chmod g+s /shared/dir       # setgid: new files inherit group
chmod +t /tmp               # sticky: only owner can delete

# Change ownership
chown user:group file
chown -R www-data:www-data /var/www/

# Default permissions (umask)
umask              # show current (e.g. 0022)
umask 027          # new files: 640, dirs: 750

# Find dangerous permissions
find / -perm -4000 2>/dev/null   # setuid files
find / -perm -2000 2>/dev/null   # setgid files
find /tmp -perm -0002 -not -perm -1000  # world-writable without sticky

# View ACLs
getfacl file
getfacl -R /dir

# Grant user alice read+write
setfacl -m u:alice:rw file

# Grant group devs read access to directory
setfacl -m g:devs:r /data

# Default ACL — inherited by new files in directory
setfacl -d -m u:alice:rw /shared/dir

# Remove an ACL entry
setfacl -x u:alice file

# Remove all ACLs
setfacl -b file

# Copy ACL from one file to another
getfacl source | setfacl --set-file=- dest

# Check auditd status
systemctl status auditd
auditctl -s

# Watch a file for any access
auditctl -w /etc/passwd -p warx -k passwd-changes
# -p: permissions to watch (r=read, w=write, a=attr, x=exec)
# -k: key tag for searching

# Audit syscalls (e.g., all execve calls by non-root)
auditctl -a always,exit -F arch=b64 -S execve -F uid!=0 -k user-execve

# List active rules
auditctl -l

# Delete all rules
auditctl -D

# Search audit log
ausearch -k passwd-changes
ausearch -m execve --start today
ausearch -ua 1000          # by UID

# Generate summary report
aureport --summary
aureport --login           # login events
aureport --failed          # failed events

# /etc/audit/rules.d/hardening.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /var/log/auth.log -p wa -k authlog
-a always,exit -F arch=b64 -S setuid -k privilege-escalation
-a always,exit -F arch=b64 -S mount -k mounts

# /etc/pam.d/sshd (example)
auth       required     pam_faillock.so preauth
auth       required     pam_unix.so
auth       required     pam_faillock.so authfail

account    required     pam_unix.so
account    required     pam_nologin.so

session    required     pam_limits.so       # enforce ulimits
session    required     pam_unix.so
session    optional     pam_motd.so

# Lock out after 5 failed attempts (pam_faillock)
# /etc/security/faillock.conf:
# deny = 5
# unlock_time = 900

# Check faillock status
faillock --user alice

# Unlock a user
faillock --user alice --reset

# Enforce password complexity (pam_pwquality)
# /etc/security/pwquality.conf:
# minlen = 12
# dcredit = -1   # at least 1 digit
# ucredit = -1   # at least 1 uppercase
# lcredit = -1   # at least 1 lowercase