Generally, the kernel looks at the process's capabilities to see if it has the required capability. You will find this information documented in the manual page of the relevant system call, which will note that "the process needs capability CAP_XYZ" in order to perform the operation. For example, looking at the manual page of
kill(2), we see:
For a process to have permission to send a signal, it must either
be privileged (under Linux: have the CAP_KILL capability in the
user namespace of the target process), or the real or effective
user ID of the sending process must equal the real or saved set-
user-ID of the target process.
Similarly in the
create_module(2) page, we see:
create_module() attempts to create a loadable module entry and
reserve the kernel memory that will be needed to hold the module.
This system call requires privilege.
EPERM The caller was not privileged (did not have the
The kernel is able to make these checks because capabilities are per-process attributes that the kernel records in its internal data structures.