In classic UNIX (and Linux), there are exactly two kinds of processes when it comes to privilege:

This is an all-or-nothing design. If you want a program to change the system clock — a single privileged operation — you must run it as root. But running it as root also gives it the ability to:

• Read and write any file on the system
• Send signals to any process
• Load or unload kernel modules
• Bypass all file permission checks
• Reboot the system
• …and hundreds of other privileged operations

This is the principle of least privilege violation. A program that only needs to adjust the clock should not have the ability to delete files or kill arbitrary processes. If such a program has a bug or is exploited by a malicious user, the damage it can cause is catastrophic.

The Linux capabilities scheme solves this by splitting the single “root superpower” into around 40 distinct units called capabilities. Each capability covers a specific category of privileged operations.

For example:

A process can be granted only CAP_SYS_TIME to change the clock, without getting any other privileges. If the process is compromised, the attacker still cannot read protected files or kill system processes, because the process never had those capabilities.

Most of the time, capabilities are invisible to normal application developers. This is because when a process assumes an effective user ID of 0 (root), the kernel automatically grants it the full set of all capabilities. So existing root-based programs continue to work exactly as before — capabilities are fully backward-compatible.

The Linux capabilities implementation is based on the POSIX 1003.1e draft standard. Although this standardization effort was never completed (it was abandoned in the late 1990s), Linux and other UNIX systems (Sun Solaris, SGI Trusted IRIX, TrustedBSD for FreeBSD) all implemented capabilities based on the draft. Some capabilities in Linux are directly from the draft; many others are Linux-specific extensions.

In each of these cases, the capabilities approach means that even if the service is completely taken over by an attacker, they gain only the specific capability the process had — not full root access over the entire system.

Before manipulating capabilities, you first need to know how to view them. Linux exposes each process’s three capability sets via the /proc/PID/status file. The following program reads and prints the raw capability bitmasks for the calling process, then shows how to interpret them using the libcap library’s human-readable API.

The three fields of interest in /proc/self/status are:

• CapInh — Inheritable capability set (hex bitmask)
• CapPrm — Permitted capability set (hex bitmask)
• CapEff — Effective capability set (hex bitmask)

/*
 * show_caps.c
 *
 * Demonstrates two ways to inspect process capabilities:
 *   1. Directly reading /proc/self/status (raw hex bitmasks)
 *   2. Using the libcap API for human-readable output
 *
 * Compile:
 *   gcc -o show_caps show_caps.c -lcap
 *
 * Run as normal user:
 *   ./show_caps
 *
 * Run as root:
 *   sudo ./show_caps
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/capability.h>   /* libcap header */
#include <unistd.h>

/* ---------------------------------------------------------------
 * Method 1: Read raw capability bitmasks from /proc/self/status
 * This works without libcap — just file I/O.
 * --------------------------------------------------------------- */
static void show_raw_caps(void)
{
    FILE *fp;
    char line[256];

    printf("=== Raw capability bitmasks from /proc/self/status ===\n");

    fp = fopen("/proc/self/status", "r");
    if (fp == NULL) {
        perror("fopen /proc/self/status");
        return;
    }

    while (fgets(line, sizeof(line), fp) != NULL) {
        /*
         * We are looking for lines that start with:
         *   CapInh:   (Inheritable)
         *   CapPrm:   (Permitted)
         *   CapEff:   (Effective)
         *   CapBnd:   (Bounding set)
         */
        if (strncmp(line, "CapInh:", 7) == 0 ||
            strncmp(line, "CapPrm:", 7) == 0 ||
            strncmp(line, "CapEff:", 7) == 0 ||
            strncmp(line, "CapBnd:", 7) == 0)
        {
            /*
             * Each line looks like:
             *   CapPrm:	0000000000000000
             * A value of 0000000000000000 means no capabilities.
             * A value of 0000003fffffffff means all capabilities set.
             */
            printf("  %s", line);  /* line already has '\n' */
        }
    }
    fclose(fp);
    printf("\n");
}

/* ---------------------------------------------------------------
 * Method 2: Use libcap to get human-readable capability strings.
 * cap_get_proc()  — fetches the current process cap sets
 * cap_to_text()   — converts them to a readable string
 * cap_free()      — frees memory allocated by libcap
 * --------------------------------------------------------------- */
static void show_caps_libcap(void)
{
    cap_t caps;
    char *text;

    printf("=== Human-readable capabilities via libcap ===\n");

    /*
     * cap_get_proc() returns a cap_t structure representing
     * all three capability sets (permitted, effective, inheritable)
     * of the calling process.
     *
     * Returns NULL on error.
     */
    caps = cap_get_proc();
    if (caps == NULL) {
        perror("cap_get_proc");
        return;
    }

    /*
     * cap_to_text() converts the cap_t structure into a
     * human-readable string. The second argument (if non-NULL)
     * is set to the length of the returned string.
     *
     * Example outputs:
     *   Normal user:  ""  (empty — no capabilities)
     *   Root:         "=ep"  (all capabilities, permitted + effective)
     */
    text = cap_to_text(caps, NULL);
    if (text == NULL) {
        perror("cap_to_text");
        cap_free(caps);
        return;
    }

    printf("  Capability sets: [%s]\n\n", text);

    if (strlen(text) == 0) {
        printf("  (No capabilities — this is a normal unprivileged process)\n\n");
    }

    /*
     * IMPORTANT: Always free libcap-allocated memory with cap_free(),
     * not with the regular free(). This applies to both cap_t handles
     * and strings returned by cap_to_text().
     */
    cap_free(text);
    cap_free(caps);
}

int main(void)
{
    printf("Process capabilities viewer\n");
    printf("PID: %d   UID: %d   EUID: %d\n\n",
           (int)getpid(), (int)getuid(), (int)geteuid());

    /* Method 1 — raw /proc parsing */
    show_raw_caps();

    /* Method 2 — libcap API */
    show_caps_libcap();

    printf("Tip: Run this program with 'sudo' to see all capabilities set.\n");
    return 0;
}

Process capabilities viewer
PID: 4821   UID: 1000   EUID: 1000

=== Raw capability bitmasks from /proc/self/status ===
  CapInh:	0000000000000000
  CapPrm:	0000000000000000
  CapEff:	0000000000000000
  CapBnd:	000001ffffffffff

=== Human-readable capabilities via libcap ===
  Capability sets: []
  (No capabilities — this is a normal unprivileged process)

  CapPrm:	000001ffffffffff
  CapEff:	000001ffffffffff
  Capability sets: [=ep]