I tried adding cap_sys_admin permissions to user myroot.

For this, I added these lines to /etc/security/capabilities:

cap_sys_admin myroot
none *

and this line to /etc/pam.d/su:

auth            required        pam_cap.so

But user myroot doesn't have these permissions.

What can I do to add these permissions to my user?

1 Answer 1


I believe the file is called /etc/security/capability.conf not /etc/security/capabilities. I was able to get this working like so:

$ cat /etc/security/capability.conf
cap_sys_admin   user1

And then adding pam_cap.so to PAM. NOTE: It's imperative that pam_cap.so come before the pam_rootok.so line.

$ cat /etc/pam.d/su
auth        optional    pam_cap.so
auth        sufficient  pam_rootok.so


Here with the above in place if I run the following su command:

$ su - user1

I can verify this user's capabilities:

$ capsh --print
Current: = cap_sys_admin+i
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,35,36
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)

The key line in that output:

Current: = cap_sys_admin+i


This was done on a CentOS 7.x box. I had these packages installed pertaining to capabilities:

$ rpm -qa | grep libcap

They provide the following useful tools when dealing with capabilities:

$ rpm -ql libcap-ng-utils | grep /bin/

$ rpm -ql libcap | grep /sbin/

NOTE: See the respective man pages for these tools if you need more info on their usage.


  • 1
    Tnx a lot! It solved my problem! Jul 12, 2018 at 13:18
  • 1
    On Debian, the package libpam-cap is required. Jul 27, 2021 at 9:38
  • Doesn't work for me :-(
    – einpoklum
    Dec 15, 2021 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.