CKS System Hardening Practice Question
Which Linux capability must be added to a container to allow it to change the system time (e.g., using the 'date' command)?
⚠ Common exam trap
CNCF often tests the distinction between `CAP_SYS_ADMIN` (a catch-all for many privileged operations) and `CAP_SYS_TIME` (the specific capability for clock manipulation), leading candidates to incorrectly select `CAP_SYS_ADMIN` because they assume it covers all system administration tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CAP_SYS_TIME
The `CAP_SYS_TIME` capability is specifically required for a container to modify the system clock, including using the `date` command to set the time. Without this capability, the container's process will receive an EPERM error when attempting to change the system time, as the kernel enforces this restriction at the system call level (e.g., `settimeofday`, `clock_settime`).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CAP_SYS_NICE
Why it's wrong here
CAP_SYS_NICE controls process scheduling attributes: it lets a process raise the nice value (lower priority) or lower nice value for other processes, set real-time scheduling policies, adjust CPU affinity, and set I/O scheduling class. It has no relation to the system clock or the timekeeping syscalls such as settimeofday() or clock_settime(), which are gated by CAP_SYS_TIME. Granting CAP_SYS_NICE would let a container manipulate scheduling, not set the date or time.
- ✗
CAP_SYS_RESOURCE
Why it's wrong here
CAP_SYS_RESOURCE permits a process to overstep resource limits, such as RLIMIT_NOFILE, RLIMIT_NPROC, or disk-space quotas, and to alter reserved ext4 filesystem blocks. It does not expose any time-related syscalls; changing the system time is handled exclusively by CAP_SYS_TIME, which guards clock_settime(), settimeofday(), stime(), and adjtimex(). A container with CAP_SYS_RESOURCE would be able to exhaust file descriptors or bypass quota limits, but it still could not modify the system or real-time clock.
- ✗
CAP_SYS_ADMIN
Why it's wrong here
CAP_SYS_ADMIN grants broad kernel access, including namespace manipulation and mounting, but changing system time specifically requires CAP_SYS_TIME, which controls the clock settimeofday and adjtimex syscalls. CAP_SYS_ADMIN is tempting because it covers many privileged operations, such as adjusting kernel parameters or device control, and would be correct for tasks like mounting filesystems or enabling raw socket creation.
- ✓
CAP_SYS_TIME
Why this is correct
CAP_SYS_TIME is the exact capability that grants a process permission to set or adjust the system clock and the hardware real-time clock (RTC). It covers the settimeofday(), stime(), clock_settime(), and adjtimex() syscalls, so a container with this capability can change the current date and time on the host. For a container to change time, this capability must be explicitly added to its securityContext.capabilities.add list, since it is not part of the default allowed capability set in Docker or Kubernetes.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.