title: Using linux capabilities in c
body: <p>I am trying to understand how capabilities work and I am using code from here:</p>
  <p><a href="https://gist.github.com/sbz/1090868" rel="nofollow noreferrer">https://gist.github.com/sbz/1090868</a></p>
  <p>I created an array with all the permissions:</p>
  <pre><code> cap_value_t cap_list_[] = {
          CAP_CHOWN,
          CAP_DAC_OVERRIDE,
          CAP_DAC_READ_SEARCH,
          CAP_FOWNER,
          CAP_FSETID,
          CAP_KILL,
          CAP_SETGID,
          CAP_SETUID,
          CAP_SETPCAP,
          CAP_LINUX_IMMUTABLE,
          CAP_NET_BIND_SERVICE,
          CAP_NET_BROADCAST,
          CAP_NET_ADMIN,
          CAP_NET_RAW,
          CAP_IPC_LOCK,
          CAP_IPC_OWNER,
          CAP_SYS_MODULE,
          CAP_SYS_RAWIO,
          CAP_SYS_CHROOT,
          CAP_SYS_PTRACE,
          CAP_SYS_PACCT,
          CAP_SYS_ADMIN,
          CAP_SYS_BOOT,
          CAP_SYS_NICE,
          CAP_SYS_RESOURCE,
          CAP_SYS_TIME,
          CAP_SYS_TTY_CONFIG,
          CAP_MKNOD,
          CAP_LEASE,
          CAP_AUDIT_WRITE,
          CAP_AUDIT_CONTROL,
          CAP_SETFCAP,
          CAP_MAC_OVERRIDE,
          CAP_MAC_ADMIN
      };
  </code></pre>
  <p>I then try to disable everything:</p>
  <pre><code> if (cap_set_flag(cap, CAP_PERMITTED, 34, cap_list_, CAP_CLEAR) == -1) {
          perror(&quot;cap_set_flag cap_mac_admin&quot;);
          cap_free(cap);
          exit(-1);
      }
      if (cap_set_flag(cap, CAP_EFFECTIVE, 34, cap_list_, CAP_CLEAR) == -1) {
          perror(&quot;cap_set_flag cap_mac_admin&quot;);
          cap_free(cap);
          exit(-1);
      }
  </code></pre>
  <p>I then try to do the following:</p>
  <pre><code>chown(&quot;/home/user/test/file&quot;, 500, 500);
  </code></pre>
  <p>This works. This changes the owner of the file.
  This is just for testing purposes but I thought with all the permissions revoked I would not be able to do this.</p>