Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Right now I'm using cap_net_bind_service MY_USERNAME in /etc/security/capability.conf.
Now I just need to set cap_net_bind_service+i on the interpreter of my favouite scripting language to be able to add CAP_NET_BIND_SERVICE to the effective set via libcap[-ng].

This works fine, but I wonder if there's a way to achieve the same thing without setting any caps to the interpreter binary. While it's not a big problem (other user accounts don't have the cap so they can't use it even with the bit set on the interpreter binary) it's somewhat annoying since I have to re-set the flag everytime the interpreter is updated.

share|improve this question

Usually, the capabilities are inherited to the children. As stated in the manpage :

A child created via fork(2) inherits copies of its parent's capability sets.

The issue with the scripts is they are not executables. Your calling program (usually the shell) has to check the first line for a shebang, then call the real interpreter (set in the shebang) with your script as argument.

This mean you'll have to set the capability on the interpreter, not on the script. The same thing applies to suid bits, and other special flags.

So either you make a copy of your interpreter, set the capabilities you want on it (also check that nobody can access it through chmod/chown), and call this copied interpreter in your shebang. You also may do the setcap logic in your script.

share|improve this answer
Ok, didn't saw the question was asked 2 years ago but never closed... Also, seems like a duplicate of unix.stackexchange.com/questions/87348/… – Adrien M. Oct 24 '14 at 14:22
but only i (inherit), gets past exec. And i does nothing on its own, it only works if the file has a matching i, and I thing the e (effective) bit (unless the script/executable sets that). It is even more complex that setuid, this is not a script effect. – richard Apr 16 '15 at 14:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.