Ollama: Ollama: improve existing draft article

2026-10-13T23:48:26Z

Ollama: improve existing draft article

← Older revision		Revision as of 23:48, 13 October 2026
Line 1:		Line 1:
			In computing, particularly within the Linux operating system, [[Capabilities]] refer to a security mechanism that allows processes to perform specific privileged operations without requiring full root (administrator) privileges. This model provides a more fine-grained approach to privilege management compared to traditional Unix-style setuid binaries, which grant full root access to processes. By restricting [[Capabilities]] to only what is necessary, the system reduces potential attack surfaces and enhances overall security. The concept is implemented through several mechanisms, including ambient [[Capabilities]] and the capability bounding set, which differ in their scope and behavior.
⚫	https://unix.stackexchange.com/questions/580597/what-is-the-difference-between-ambientcapabilities-and-capabilityboundingset

			{{H2\|Ambient [[Capabilities]]}}
			Ambient [[Capabilities]] represent a set of permissions that are inherited by child processes from their parent. These [[Capabilities]] are preserved across execve() system calls, meaning that a process can retain certain privileges even after executing a new program. However, ambient [[Capabilities]] are subject to the capability bounding set, which acts as an upper limit on what can be inherited or activated. This design ensures that even if a parent process has broad permissions, child processes are restricted based on the bounding set's configuration.

			{{H2\|Capability Bounding Set}}
			The capability bounding set is a kernel-enforced limit that defines the maximum set of [[Capabilities]] a process can possess. It is a global system-wide parameter that cannot be exceeded by any process, regardless of its parent's permissions. This set is typically configured during system boot or through administrative tools and is used to prevent privilege escalation attacks. For example, if the bounding set excludes the CAP_SYS_ADMIN capability, no process—parent or child—can activate or inherit that specific privilege, even if the ambient [[Capabilities]] suggest otherwise.

			{{H2\|Key Differences}}
			The primary distinction between ambient [[Capabilities]] and the capability bounding set lies in their scope and enforceability. Ambient [[Capabilities]] are process-specific and inheritable, while the bounding set is a system-wide hard limit. Additionally, ambient [[Capabilities]] are always subsets of the bounding set, ensuring that no process can exceed the kernel's defined restrictions. This hierarchical relationship allows administrators to define broad ambient permissions while maintaining strict system-wide boundaries through the bounding set.

			{{H2\|Usage and Examples}}
			These mechanisms are commonly managed using tools like `setcap` and `getcap`, which modify the [[Capabilities]] of binaries or processes. For instance, a server application might be granted the CAP_NET_BIND_SERVICE capability to bind to privileged ports without requiring full root access. However, the bounding set would ensure that this capability cannot be extended beyond its defined limits. Administrators must carefully configure both ambient [[Capabilities]] and the bounding set to balance functionality and security.

		⚫	For further technical details and discussions on this topic, see [https://unix.stackexchange.com/questions/580597/what-is-the-difference-between-ambientcapabilities-and-capabilityboundingset].

	{{Draft}}
	{{Linux}}		{{Linux}}

			{{Ollama}}
			{{Pending Human Review}}

Robert Brockway at 04:17, 27 June 2025

2025-06-27T04:17:02Z

← Older revision		Revision as of 04:17, 27 June 2025
Line 1:		Line 1:
			https://unix.stackexchange.com/questions/580597/what-is-the-difference-between-ambientcapabilities-and-capabilityboundingset



	{{Draft}}		{{Draft}}

Robert Brockway: Created page with " {{Draft}} {{Linux}}"

2024-05-23T06:42:59Z

Created page with " {{Draft}} {{Linux}}"

New page

Capabilities - Revision history

Ollama: Ollama: improve existing draft article

Robert Brockway at 04:17, 27 June 2025

Robert Brockway: Created page with " {{Draft}} {{Linux}}"