These capabilities control what a process can do with files and directories on the filesystem, independently of the normal read/write/execute permission bits.

These capabilities govern what a process can do to other processes — sending signals, changing user/group IDs, and tracing.

These capabilities control privileged network operations — binding to low-numbered ports, using raw sockets, configuring network interfaces.

These are the most powerful and broad capabilities. CAP_SYS_ADMIN in particular is sometimes called “the new root” because it covers such a wide range of operations.

Here is a visual summary grouping all capabilities by their primary domain:

Often you want to check whether the current process has a specific capability before attempting a privileged operation. This avoids failing with a cryptic EPERM error. The libcap API provides cap_get_flag() to inspect individual capabilities within any of the three sets.

This program demonstrates checking for CAP_NET_BIND_SERVICE (needed to bind to port 80) and CAP_SYS_TIME (needed to change the system clock), before attempting those operations.

/*
 * check_specific_cap.c
 *
 * Shows how to check for specific capabilities using libcap
 * before attempting privileged operations.
 *
 * Compile:
 *   gcc -o check_specific_cap check_specific_cap.c -lcap
 *
 * Usage:
 *   ./check_specific_cap
 *   sudo ./check_specific_cap
 *   sudo setcap cap_net_bind_service+ep ./check_specific_cap
 *   ./check_specific_cap
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/capability.h>
#include <unistd.h>

/*
 * has_capability() - Test if the calling process has a specific
 * capability in a specific set (effective, permitted, or inheritable).
 *
 * @cap_value:  The capability to check (e.g., CAP_NET_BIND_SERVICE)
 * @cap_set:    Which set to check: CAP_EFFECTIVE, CAP_PERMITTED,
 *              or CAP_INHERITABLE
 *
 * Returns:
 *   1  if the capability is set
 *   0  if the capability is NOT set
 *  -1  on error
 */
int has_capability(cap_value_t cap_value, cap_flag_t cap_set)
{
    cap_t caps;
    cap_flag_value_t flag_value;  /* Will be CAP_SET or CAP_CLEAR */
    int result;

    /*
     * Step 1: Get the capability sets of the current process.
     * cap_get_proc() allocates a cap_t structure and fills it
     * with the three capability sets from the kernel.
     */
    caps = cap_get_proc();
    if (caps == NULL) {
        perror("cap_get_proc");
        return -1;
    }

    /*
     * Step 2: Check the flag for a specific capability in a specific set.
     *
     * cap_get_flag(cap_t, cap_value_t, cap_flag_t, cap_flag_value_t *)
     *   - caps:        the capability structure from cap_get_proc()
     *   - cap_value:   which capability (e.g. CAP_NET_BIND_SERVICE)
     *   - cap_set:     which set (CAP_EFFECTIVE, CAP_PERMITTED, CAP_INHERITABLE)
     *   - &flag_value: OUTPUT — set to CAP_SET or CAP_CLEAR
     *
     * Returns 0 on success, -1 on error.
     */
    if (cap_get_flag(caps, cap_value, cap_set, &flag_value) == -1) {
        perror("cap_get_flag");
        cap_free(caps);
        return -1;
    }

    result = (flag_value == CAP_SET) ? 1 : 0;

    /* Step 3: Always free the cap_t structure when done */
    cap_free(caps);

    return result;
}

/*
 * print_cap_status() - Print a yes/no status line for a capability check
 */
void print_cap_status(const char *cap_name, cap_value_t cap_val)
{
    int in_effective  = has_capability(cap_val, CAP_EFFECTIVE);
    int in_permitted  = has_capability(cap_val, CAP_PERMITTED);

    printf("  %-30s  Permitted: %-3s  Effective: %-3s\n",
           cap_name,
           (in_permitted == 1)  ? "YES" : "NO",
           (in_effective == 1)  ? "YES" : "NO");
}

int main(void)
{
    printf("Capability check for PID=%d (UID=%d, EUID=%d)\n\n",
           (int)getpid(), (int)getuid(), (int)geteuid());

    printf("  %-30s  %-14s  %-14s\n", "Capability", "In Permitted", "In Effective");
    printf("  %s\n", "---------------------------------------------------------------");

    /*
     * Check capabilities that are commonly needed by system programs.
     *
     * CAP_NET_BIND_SERVICE: bind to privileged ports (< 1024)
     * CAP_SYS_TIME:         change system clock
     * CAP_NET_RAW:          use raw sockets (ping, tcpdump)
     * CAP_DAC_OVERRIDE:     bypass file permission checks
     * CAP_SYS_ADMIN:        broad system administration
     * CAP_SYS_MODULE:       load/unload kernel modules
     * CAP_KILL:             send signals to any process
     * CAP_CHOWN:            change file ownership
     */
    print_cap_status("CAP_NET_BIND_SERVICE",  CAP_NET_BIND_SERVICE);
    print_cap_status("CAP_SYS_TIME",          CAP_SYS_TIME);
    print_cap_status("CAP_NET_RAW",           CAP_NET_RAW);
    print_cap_status("CAP_DAC_OVERRIDE",      CAP_DAC_OVERRIDE);
    print_cap_status("CAP_SYS_ADMIN",         CAP_SYS_ADMIN);
    print_cap_status("CAP_SYS_MODULE",        CAP_SYS_MODULE);
    print_cap_status("CAP_KILL",              CAP_KILL);
    print_cap_status("CAP_CHOWN",             CAP_CHOWN);

    printf("\n");

    /*
     * Practical example: decide whether to attempt a privileged
     * operation based on capability check, rather than just trying
     * and catching EPERM.
     */
    printf("--- Practical capability-aware decision making ---\n");

    if (has_capability(CAP_NET_BIND_SERVICE, CAP_EFFECTIVE) == 1) {
        printf("  OK: Can bind to privileged ports (< 1024). Safe to call bind().\n");
    } else {
        printf("  WARNING: Missing CAP_NET_BIND_SERVICE.\n");
        printf("  Cannot bind to ports below 1024 without running as root\n");
        printf("  or setting: sudo setcap cap_net_bind_service+ep <program>\n");
    }

    if (has_capability(CAP_SYS_TIME, CAP_EFFECTIVE) == 1) {
        printf("  OK: Can change the system clock. Safe to call settimeofday().\n");
    } else {
        printf("  WARNING: Missing CAP_SYS_TIME. Cannot change system clock.\n");
    }

    return 0;
}

  Capability                      In Permitted    In Effective
  ---------------------------------------------------------------
  CAP_NET_BIND_SERVICE            NO             NO
  CAP_SYS_TIME                    NO             NO
  ...
  WARNING: Missing CAP_NET_BIND_SERVICE.
  Cannot bind to ports below 1024...

  CAP_NET_BIND_SERVICE            YES            YES
  OK: Can bind to privileged ports (< 1024).