Linux Capabilities in a nutshell (2019)
Nice article.  I&#x27;d like to make 2 additions:<p>#1: I disagree with the very first sentence (&quot;Capabilities are being use more and more, mainly thanks to SystemD, Docker and orchestrators like Kubernetes.&quot;) - a lot of old-fashioned daemons already use capabilities to limit their privileges and&#x2F;or raise and lower them as needed.<p>#2: pspax from pax-utils is a great tool to show process capabilities:<p><pre><code>  # pspax
  USER     PID    PAX    MAPS ETYPE      NAME             CAPS ATTR  
  root     1      ---    w^x  ET_DYN     init             =ep  system_u:system_r:init_t:s0  
  root     2575   ---    w^x  ET_DYN     udevd            =ep  system_u:system_r:kernel_t:s0  
  root     2752   ---    w^x  ET_DYN     dmeventd         =ep  system_u:system_r:kernel_t:s0  
  root     60844  ---    w^x  ET_DYN     auditd           =ep  system_u:system_r:kernel_t:s0  
  root     60879  ---    w^x  ET_DYN     crond            =ep  system_u:system_r:kernel_t:s0  
  root     60910  ---    w^x  ET_DYN     ntpd             cap_net_bind_service,cap_ipc_lock,cap_sys_time=ep system_u:system_r:kernel_t:s0  
  root     61532  ---    w^x  ET_DYN     lxc-start        =ep  system_u:system_r:kernel_t:s0  
  -------- 61542  ---    w^x  ET_EXEC    init             =eip system_u:system_r:kernel_t:s0  
  root     66327  ---    w^x  ET_DYN     lxc-start        =ep  system_u:system_r:kernel_t:s0  
  -------- 66328  ---    w^x  ET_EXEC    init             =eip system_u:system_r:kernel_t:s0  
  root     70543  ---    w^x  ET_DYN     zebra            cap_net_admin,cap_net_raw,cap_sys_admin=p system_u:system_r:kernel_t:s0  
  root     70785  ---    w^x  ET_DYN     ospfd            cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_admin=p system_u:system_r:kernel_t:s0  
  root     70794  ---    w^x  ET_DYN     ospf6d           cap_net_bind_service,cap_net_raw=p system_u:system_r:kernel_t:s0  
  root     71529  ---    w^x  ET_DYN     bgpd             cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_admin=p system_u:system_r:kernel_t:s0  
  root     71770  ---    w^x  ET_DYN     syslog-ng        =ep  system_u:system_r:kernel_t:s0  
  root     71771  ---    w^x  ET_DYN     syslog-ng        cap_syslog=ep cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_net_bind_service,cap_net_broadcast,cap_net_raw+p system_u:system_r:kernel_t:s0
  [...]
</code></pre>
(Note: in some versions of pspax, this is unfortunately broken; if you see everything with only &quot;=ep&quot;, that&#x27;s probably not right.)