Setting POSIX Capabilities

POSIX capabilities allow fine-grained permissions for processes. In additionto the standard UNIX permission scheme, they define a new set of privileges forsystem resources. To enable capabilities support (Linux Only) you have toinstall the libcap headers (libcap-dev on Debian-based distros) beforebuilding uWSGI. As usual your processes will lose practically all of thecapabilities after a setuid call. The uWSGI cap option allows you todefine a list of capabilities to maintain through the call.

For example, to allow your unprivileged app to bind on privileged ports and setthe system clock, you will use the following options.

uwsgi --socket :1000 --uid 5000 --gid 5000 --cap net_bind_service,sys_time

All of the processes generated by uWSGI will then inherit this behaviour. Ifyour system supports capabilities not available in the uWSGI list you cansimply specify the number of the constant:

uwsgi --socket :1000 --uid 5000 --gid 5000 --cap net_bind_service,sys_time,42

In addition to net_bind_service and sys_time, a new capability numbered ‘42’ is added.

Available capabilities

This is the list of available capabilities.