Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities.
What is the difference between file and process capabilities. What I understood is we assign capability to an executable by using setcap and then when it is running which is a process it will use that capabilities. Why additional process capabilities, as process is executable file in memory.
File capabilities are set on an executable file with setcap.
But other capabilities can be inherited from the launching process. This is described in the Linux capabilites man page:
Inheritable
This is a set of capabilities preserved across an execve(2).
Inheritable capabilities remain inheritable when executing any
program, and inheritable capabilities are added to the
permitted set when executing a program that has the
corresponding bits set in the file inheritable set.
Serge E. Hallyn and I wrote this paper on capabilities way back in 2008 just after we first implemented file capabilities in the Linux kernel. It contains some history, some theory and a whole bunch of simple worked examples that still do a reasonable hands-on walk through trying to explain how things work. I'm also trying harder to keep other reference and example material on the Fully Capable site.
