I understand that Linux capabilities are defined on processes/files. But when I do capsh --print, it tells me the capabilities of the user.
So what exactly is capsh --print doing? Capabilities are only defined on processes, and not users?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
capsh is a tool for exploring how to use and validate capabilities and the API
libcap offers. You can use it to debug what happens when kinds of questions.
An important property of
capsh is that it evaluates its arguments strictly in left to right order. So, when you are trying to figure out why something is not ending up in the state you want, you can insert a
You should think of it as a kind of a swiss-army-knife of capability related functions. The
libcap build tree uses it in
quicktest.sh to validate the library still works against modern kernels etc. That script contains a whole bunch of worked examples and expected results for using
libcap and kernel features.
This includes Ambient capability and also non-standard kernel operating modes (aka
For example because of the way the kernel works, these two sequences yield different results:
$ sudo capsh --iab=^cap_dac_override --user=$(whoami) --print $ sudo capsh --user=$(whoami) --iab=^cap_dac_override --print
You can automate answering the question of Did that raise the ambient bit with something like this:
$ sudo capsh --user=$(whoami) --iab=^cap_dac_override --has-a=cap_dac_override && echo yes
Also, if you want to explore the world as the POSIX.1e draft committee imagined, you can try something like this:
$ sudo capsh --mode=PURE1E --user=$(whoami) --
Simple. It is NOT the capabilities of the user. It is the capabilities of it self. So stuff that it inherited from its parent.
I remember (a few years back) being in a discussion about
capsh, we were trying to work out what is was for. We decided that it was next to useless, the discussion lead to the invention of Ambient capabilities (Inherited and Effective). I have not tried
capsh since the existence of ambient capabilities. They are only needed if creating a
sudo of capabilities (such as
capsh). Or sometime a more specialist wrapper.