How to use Linux capabilities instead of root

· Category: Linux

Short answer

Linux capabilities divide root privileges into fine-grained units that can be assigned to specific programs.

Steps

  1. View capabilities:
getcap /usr/bin/ping
  1. Add a capability:
sudo setcap cap_net_raw+ep /usr/bin/ping
  1. Remove a capability:
sudo setcap -r /usr/bin/ping
  1. List all capabilities in /proc/PID/status.

Tips

  • Capabilities reduce attack surface compared to setuid root binaries.
  • +ep means effective and permitted sets.
  • Containers use capability dropping to restrict processes.

Common issues

  • Capabilities are lost when files are moved across filesystems.
  • Not all operations can be mapped to capabilities; some still need root.