An answer to Linux: allowing an user to listen to a port below 1024 specified giving an executable additional permissions using setcap such that the program could bind to ports <1024:

setcap 'cap_net_bind_service=+ep' /path/to/program

What is the correct way to undo these permissions?

2 Answers 2


To remove capabilities from a file use the -r flag

setcap -r /path/to/program

This will result in the program having no capabilities.

  • Well, that was a lot more evident after re-reading that short man page >.> Aug 15, 2016 at 2:07
  • How can I confirm that the setcap -r command worked as intended? Jan 28 at 13:39
  • 1
    @dotnetCarpenter Use getcap Jan 31 at 18:00

What @stephen-harris posted is right. But I believe it removes all capabilities added to the program in one shot. To remove a specific capability, following would work (following the example in the question)

setcap 'cap_net_bind_service=-ep' /path/to/program,

Notice the '-' sign. You can verify the {effect of the commands} capabilities over an executable as follows :

getcap /path/to/program

In case of setcap -r, all capabilities will be gone and the result of getcap will be empty where as the '-ep' just removes what you added with '+ep'. Comes in handy when you gave multiple capabilities and want to selectively remove them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.