What does capsh --print actually do?

Question

I understand that Linux capabilities are defined on processes/files. But when I do capsh --print, it tells me the capabilities of the user.

So what exactly is capsh --print doing? Capabilities are only defined on processes, and not users?

Answer 1

capsh is a tool for exploring how to use and validate capabilities and the API libcap offers. You can use it to debug what happens when kinds of questions.

An important property of capsh is that it evaluates its arguments strictly in left to right order. So, when you are trying to figure out why something is not ending up in the state you want, you can insert a --print argument to figure it out: --print just outputs the current state of the process executing capsh.

You should think of it as a kind of a swiss-army-knife of capability related functions. The libcap build tree uses it in quicktest.sh to validate the library still works against modern kernels etc. That script contains a whole bunch of worked examples and expected results for using libcap and kernel features.

This includes Ambient capability and also non-standard kernel operating modes (aka libcap modes).

For example because of the way the kernel works, these two sequences yield different results:

$ sudo capsh --iab=^cap_dac_override --user=$(whoami) --print
$ sudo capsh --user=$(whoami) --iab=^cap_dac_override --print

You can automate answering the question of Did that raise the ambient bit with something like this:

$ sudo capsh --user=$(whoami) --iab=^cap_dac_override --has-a=cap_dac_override && echo yes

Also, if you want to explore the world as the POSIX.1e draft committee imagined, you can try something like this:

$ sudo capsh --mode=PURE1E --user=$(whoami) --

Answer 2

Simple. It is NOT the capabilities of the user. It is the capabilities of it self. So stuff that it inherited from its parent.

I remember (a few years back) being in a discussion about capsh, we were trying to work out what is was for. We decided that it was next to useless, the discussion lead to the invention of Ambient capabilities (Inherited and Effective). I have not tried capsh since the existence of ambient capabilities. They are only needed if creating a sudo of capabilities (such as capsh). Or sometime a more specialist wrapper.