Kernel capability usage statistics

(Update: 2012-07-16: I wrote a related article for this blog post, "CAP_SYS_ADMIN: the new root" that was published on LWN.net on 2012-03-14.)

The idea of capabilities is to break the power of root (user ID 0) into independently assigned pieces governing specific privileged operations. Implicit in that model is that the set of privileged operations governed by each capability should be small (otherwise, why break the power of root into pieces at all?). However, that implication hasn't turned out to be true in practice.

Table 1 shows some statistics on the use of the 36 currently existing capabilities in the C files of the Linux 3.2 kernel source code. The "#uses" column is the number of uses of the capability across all source files; the "#files" column is the number of distinct source files where the capability is used.

Table 1: Breakdown of Linux capability uses in Linux 3.2

Capability	#uses	#files
CAP_AUDIT_CONTROL	2	2
CAP_AUDIT_WRITE	1	1
CAP_CHOWN	4	2
CAP_DAC_OVERRIDE	2	1
CAP_DAC_READ_SEARCH	4	2
CAP_FOWNER	9	8
CAP_FSETID	8	6
CAP_IPC_LOCK	13	8
CAP_IPC_OWNER	1	1
CAP_KILL	2	2
CAP_LEASE	1	1
CAP_LINUX_IMMUTABLE	13	13
CAP_MAC_ADMIN	25	5
CAP_MAC_OVERRIDE	6	2
CAP_MKNOD	3	3
CAP_NET_ADMIN	395	182
CAP_NET_BIND_SERVICE	13	10
CAP_NET_BROADCAST	0	0
CAP_NET_RAW	18	11
CAP_SETFCAP	3	2
CAP_SETGID	10	6
CAP_SETPCAP	2	2
CAP_SETUID	8	4
CAP_SYS_ADMIN	451	229
CAP_SYS_BOOT	2	2
CAP_SYS_CHROOT	1	1
CAP_SYSLOG	2	2
CAP_SYS_MODULE	4	3
CAP_SYS_NICE	14	8
CAP_SYS_PACCT	1	1
CAP_SYS_PTRACE	11	6
CAP_SYS_RAWIO	67	42
CAP_SYS_RESOURCE	36	24
CAP_SYS_TIME	22	13
CAP_SYS_TTY_CONFIG	11	4
CAP_WAKE_ALARM	2	1
Total	1167	610

What is of course notable is the extremely heavy use of  two capabilities: CAP_SYS_ADMIN and CAP_NET_ADMIN. Together, these two capabilities account for more than 70% of all uses of capabilities! The uses of CAP_NET_ADMIN are limited to the drivers/ (mainly drivers/net/) and net/ directories. On the other hand, the uses of CAP_SYS_ADMIN, which accounts for nearly 39% of all capability uses, are spread widely across the kernel source tree.

One might wonder whether either of these two capabilities is overrepresented because of duplications in the drivers/ or the arch/ trees. (In particular, CAP_SYS_ADMIN is used for similar administrative functions on a lot of device drivers.) However, even if we strip drivers/ and architectures other than x86 from the measurements, the overall picture doesn't change greatly, as shown in Table 2.

Table 2: Breakdown of Linux capability uses in Linux 3.2, excluding drivers and architectures other than x86

Capability	#uses	#files
CAP_AUDIT_CONTROL	2	2
CAP_AUDIT_WRITE	1	1
CAP_CHOWN	4	2
CAP_DAC_OVERRIDE	2	1
CAP_DAC_READ_SEARCH	4	2
CAP_FOWNER	9	8
CAP_FSETID	8	6
CAP_IPC_LOCK	11	6
CAP_IPC_OWNER	1	1
CAP_KILL	1	1
CAP_LEASE	1	1
CAP_LINUX_IMMUTABLE	13	13
CAP_MAC_ADMIN	25	5
CAP_MAC_OVERRIDE	6	2
CAP_MKNOD	3	3
CAP_NET_ADMIN	167	73
CAP_NET_BIND_SERVICE	12	9
CAP_NET_BROADCAST	0	0
CAP_NET_RAW	18	11
CAP_SETFCAP	3	2
CAP_SETGID	9	5
CAP_SETPCAP	2	2
CAP_SETUID	8	4
CAP_SYS_ADMIN	167	80
CAP_SYS_BOOT	2	2
CAP_SYS_CHROOT	1	1
CAP_SYSLOG	2	2
CAP_SYS_MODULE	4	3
CAP_SYS_NICE	12	6
CAP_SYS_PACCT	1	1
CAP_SYS_PTRACE	10	5
CAP_SYS_RAWIO	10	9
CAP_SYS_RESOURCE	26	18
CAP_SYS_TIME	4	2
CAP_SYS_TTY_CONFIG	1	1
CAP_WAKE_ALARM	2	1
Total	552	291

CAP_SYS_ADMIN still accounts for 167 of 552 uses of capabilities--about 30%, and, by chance, usage of CAP_NET_ADMIN is the same.

It turns out that the overall picture hasn't changed that much since capabilities were first introduced with Linux 2.2 (Jan 1999). Then, there were 27 capabilities, broken down as shown in Table 3.

Table 3: Breakdown of Linux capability uses in Linux 2.2

Capability	#uses	#files
CAP_CHOWN	2	1
CAP_DAC_OVERRIDE	5	5
CAP_DAC_READ_SEARCH	4	4
CAP_FOWNER	7	5
CAP_FSETID	3	2
CAP_IPC_LOCK	4	2
CAP_IPC_OWNER	1	1
CAP_KILL	0	0
CAP_LINUX_IMMUTABLE	2	2
CAP_NET_ADMIN	75	32
CAP_NET_BIND_SERVICE	3	3
CAP_NET_BROADCAST	0	0
CAP_NET_RAW	8	6
CAP_SETGID	7	2
CAP_SETPCAP	2	2
CAP_SETUID	7	3
CAP_SYS_ADMIN	127	69
CAP_SYS_BOOT	1	1
CAP_SYS_CHROOT	1	1
CAP_SYS_MODULE	4	2
CAP_SYS_NICE	5	2
CAP_SYS_PACCT	1	1
CAP_SYS_PTRACE	9	9
CAP_SYS_RAWIO	2	1
CAP_SYS_RESOURCE	10	8
CAP_SYS_TIME	7	4
CAP_SYS_TTY_CONFIG	1	1
Total	298	169

In Linux 2.2, CAP_SYS_ADMIN accounted for 42% of the uses of capabilities, and CAP_NET_ADMIN accounted for 25%.

Table 4 repeats the earlier exercise of excluding drivers/ and architectures other than i386 (as the Intel arch/ directory was then named) from the Linux 2.2 data. In this case, an interesting difference emerges.

Table 4: Breakdown of Linux capability uses in Linux 2.2, excluding drivers and architectures other than i386

Capability	#uses	#files
CAP_CHOWN	2	1
CAP_DAC_OVERRIDE	5	5
CAP_DAC_READ_SEARCH	4	4
CAP_FOWNER	7	5
CAP_FSETID	3	2
CAP_IPC_LOCK	4	2
CAP_IPC_OWNER	1	1
CAP_KILL	0	0
CAP_LINUX_IMMUTABLE	2	2
CAP_NET_ADMIN	44	23
CAP_NET_BIND_SERVICE	3	3
CAP_NET_BROADCAST	0	0
CAP_NET_RAW	8	6
CAP_SETGID	7	2
CAP_SETPCAP	2	2
CAP_SETUID	7	3
CAP_SYS_ADMIN	23	17
CAP_SYS_BOOT	1	1
CAP_SYS_CHROOT	1	1
CAP_SYS_MODULE	4	2
CAP_SYS_NICE	5	2
CAP_SYS_PACCT	1	1
CAP_SYS_PTRACE	2	2
CAP_SYS_RAWIO	2	1
CAP_SYS_RESOURCE	5	4
CAP_SYS_TIME	3	1
CAP_SYS_TTY_CONFIG	1	1
Total	147	94

The overall picture differs in a way that I suspect is significant: just under 16% (23/147) of the uses of capabilities are CAP_SYS_ADMIN. (As we saw in Table 2, by Linux 3.2, this figure had grown to 30% (167/552).) This difference suggests to me that as a series of kernel developers was faced with the question: "What capability should I use to govern my new privileged kernel feature?", the answer was often something like "I don't know; maybe CAP_SYS_ADMIN?". (That certainly fits with a few anecdotal cases I've encountered while discussing things with kernel developers as I wrote man pages for new kernel features.)

The script (count_kernel_cap_uses.sh) used to generate the data for these statistics can be found here. The first and third tables above are based on analysis of the "p2" output files produced by the script. The second and fourth tables are based on analysis of the "p4" output files.