feat(security): run raw-socket tools via caps not sudo (drop GTFObins nmap root)

[ocervell]

Problem

The prod worker Docker image (.docker/Dockerfile.alpine) grants the secator
user NOPASSWD: /usr/bin/nmap * (+ arp-scan, arp) in /etc/sudoers. That's
a classic GTFObins root shell —
sudo nmap --script=/tmp/x.nse <target> executes arbitrary NSE Lua as root —
so any shell-injection vulnerability reached inside a worker process escalates
straight to root.

Fix

Run the raw-socket tools (nmap, arp-scan, arp, naabu) via Linux file
capabilities (CAP_NET_RAW/CAP_NET_ADMIN) instead of sudo, gated by a new
config flag so local/dev installs keep the simpler sudo path:

• secator/config.py: Security.privileged_mode: str = 'sudo' — 'sudo'
  (default, prepends sudo) or 'caps' (rely on setcap'd binaries). Overridable
  via SECATOR_SECURITY_PRIVILEGED_MODE.
• secator/runners/command.py: the requires_sudo sudo-prepend (self.cmd/
  self.cmd_redacted) is now gated by CONFIG.security.privileged_mode != 'caps'.
• .docker/Dockerfile.alpine (flavor-aware):
  • full image (prod): no NOPASSWD sudoers grant for nmap/arp-scan/arp.
    After tools are baked in, setcap cap_net_raw,cap_net_admin+eip is applied
    to the installed binaries (/usr/bin/nmap, /usr/bin/arp-scan, /sbin/arp,
    /home/secator/.local/bin/naabu), and security.privileged_mode is set to
    caps for the secator user.
  • lite image: unchanged — tools install at runtime so there's nothing baked
    to setcap, so it keeps the old NOPASSWD sudoers grants and default
    sudo mode. This is a known deploy-time residual; prod should prefer the
    full image.

Test plan

• Added tests/unit/test_command.py::TestCommandPrivilegedMode — with
  privileged_mode = 'caps' a requires_sudo command's self.cmd does NOT
  get sudo prepended; with 'sudo' (default) it does. 2 passed.
• flake8 clean on the changed Python files.
• Dockerfile change is CI-validated only (tool install needs network access
  not available in this environment) — full build happens on this PR's CI.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01P5vSjfkBuGAAHdKxHS3ySm

[coderabbitai]

Warning

Review limit reached

@ocervell, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 38934fd7-b090-4e55-929f-c561ae64d674

📥 Commits

Reviewing files that changed from the base of the PR and between 8fcafa6 and 6ce4c5e.

📒 Files selected for processing (4)

• .docker/Dockerfile.alpine
• secator/config.py
• secator/runners/command.py
• tests/unit/test_command.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/worker-caps-mode

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}