1

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities.

What is the difference between file and process capabilities. What I understood is we assign capability to an executable by using setcap and then when it is running which is a process it will use that capabilities. Why additional process capabilities, as process is executable file in memory.

2 Answers 2

0

File capabilities are set on an executable file with setcap.

But other capabilities can be inherited from the launching process. This is described in the Linux capabilites man page:

   Inheritable
          This is a set of capabilities preserved across an execve(2).
          Inheritable capabilities remain inheritable when executing any
          program, and inheritable capabilities are added to the
          permitted set when executing a program that has the
          corresponding bits set in the file inheritable set.
0

Serge E. Hallyn and I wrote this paper on capabilities way back in 2008 just after we first implemented file capabilities in the Linux kernel. It contains some history, some theory and a whole bunch of simple worked examples that still do a reasonable hands-on walk through trying to explain how things work. I'm also trying harder to keep other reference and example material on the Fully Capable site.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .