1

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities.

What is the difference between file and process capabilities. What I understood is we assign capability to an executable by using setcap and then when it is running which is a process it will use that capabilities. Why additional process capabilities, as process is executable file in memory.

Improve this question

2 Answers 2

Reset to default
0

File capabilities are set on an executable file with setcap.

But other capabilities can be inherited from the launching process. This is described in the Linux capabilites man page:

   Inheritable
          This is a set of capabilities preserved across an execve(2).
          Inheritable capabilities remain inheritable when executing any
          program, and inheritable capabilities are added to the
          permitted set when executing a program that has the
          corresponding bits set in the file inheritable set.
Improve this answer
0

Serge E. Hallyn and I wrote this paper on capabilities way back in 2008 just after we first implemented file capabilities in the Linux kernel. It contains some history, some theory and a whole bunch of simple worked examples that still do a reasonable hands-on walk through trying to explain how things work. I'm also trying harder to keep other reference and example material on the Fully Capable site.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .