The root capabilities have been broken up. Now A process can have a subset of them (including root having none).
By looking at the man page of capabilities, we can see what root can (normally) do.
I include a few here:
Bypass file read, write, and execute permission checks. (DAC
is an abbreviation of "discretionary access control".)
Bypass permission checks for sending signals (see kill(2)).
This includes use of the ioctl(2) KDSIGACCEPT operation.
Bind a socket to Internet domain privileged ports (port
numbers less than 1024).
* Load and unload kernel modules (see init_module(2) and
* in kernels before 2.6.25: drop capabilities from the system-
wide capability bounding set.
Set system clock (settimeofday(2), stime(2), adjtimex(2)); set
real-time (hardware) clock.
* Perform I/O port operations (iopl(2) and ioperm(2));
* access /proc/kcore;
* employ the FIBMAP ioctl(2) operation;
* open devices for accessing x86 model-specific registers
(MSRs, see msr(4));
* update /proc/sys/vm/mmap_min_addr;
* create memory mappings at addresses below the value
specified by /proc/sys/vm/mmap_min_addr;
* map files in /proc/bus/pci;
* open /dev/mem and /dev/kmem;
* perform various SCSI device commands;
* perform certain operations on hpsa(4) and cciss(4) devices;
* perform a range of device-specific operations on other
Of the ones shown here,
CAP_SYS_MODULE could be used in load a kernel module that could do it;
CAP_SYS_RAWIO could be used to open
/dev/mem; There are other ways with other capabilities, including