When exec() is called, the kernel calculates the process’s new capability sets using these three rules (where P = value before exec, P' = value after exec, F = file capability set, cap_bset = capability bounding set):

Let’s break down each rule in plain language:

The capability bounding set (cap_bset) is a per-process security mechanism that acts as a hard upper limit on what capabilities a process can gain during exec(). It serves two purposes:

Key properties of the bounding set:

• It is a per-thread (per-process) attribute, visible as CapBnd in /proc/PID/status.
• It is inherited by child processes created via fork().
• It is preserved across exec().
• On a kernel that supports file capabilities, init starts with a bounding set containing all capabilities. All other processes inherit this.
• A process can drop capabilities from its bounding set using prctl(PR_CAPBSET_DROP, cap), but it can never add them back. Dropping is irreversible.
• A process can check if a capability is in its bounding set using prctl(PR_CAPBSET_READ, cap).

To maintain complete backward compatibility with traditional UNIX programs that expect root to have all privileges, the kernel applies special rules during exec() when the process or program has a root identity. In these cases, file capability sets are ignored, and the kernel instead notionally defines the file sets as follows:

With these notional definitions, the exec() formula for a typical root process (both real and effective UID are 0) simplifies to:

In practice, since the bounding set contains all capabilities by default, this means a root process that execs any program gets all capabilities — which is exactly the traditional behavior.

This program demonstrates how to read the bounding set using prctl(PR_CAPBSET_READ) and how to drop capabilities from the bounding set using prctl(PR_CAPBSET_DROP). It shows the state before and after dropping, and explains why this is an irreversible security hardening operation.

/*
 * bounding_set_demo.c
 *
 * Demonstrates capability bounding set operations:
 *   1. Read which capabilities are in the bounding set
 *   2. Drop specific capabilities from the bounding set
 *   3. Verify the drop is permanent (cannot be restored)
 *
 * Must be run as root (or with CAP_SETPCAP) to drop from bounding set.
 *
 * Compile:
 *   gcc -o bounding_set_demo bounding_set_demo.c -lcap
 *
 * Run:
 *   sudo ./bounding_set_demo
 *
 * Inspect bounding set directly:
 *   grep CapBnd /proc/self/status | awk '{print $2}' | \
 *     xargs printf "%d\n" | xargs -I{} capsh --decode={}
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/capability.h>
#include <sys/prctl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>

/*
 * is_in_bounding_set() - Check if a capability is currently in the bounding set.
 *
 * Uses prctl(PR_CAPBSET_READ, capability).
 * Returns:
 *   1  if capability IS in the bounding set
 *   0  if capability is NOT in the bounding set
 *  -1  on error (e.g., capability number is invalid)
 */
int is_in_bounding_set(cap_value_t cap)
{
    int ret = prctl(PR_CAPBSET_READ, (unsigned long)cap, 0, 0, 0);
    if (ret == -1 && errno != EINVAL)
        perror("prctl(PR_CAPBSET_READ)");
    return ret;
}

/*
 * drop_from_bounding_set() - Permanently remove a capability from bounding set.
 *
 * Uses prctl(PR_CAPBSET_DROP, capability).
 *
 * CRITICAL: This operation is IRREVERSIBLE for the calling process and all
 * descendants. Once dropped, the capability cannot be added back to the
 * bounding set. If exec() is called with a file that has this capability
 * in its file permitted set, the capability will be filtered out.
 *
 * Requires: CAP_SETPCAP in the process's effective set (usually means root).
 *
 * Returns 0 on success, -1 on failure.
 */
int drop_from_bounding_set(cap_value_t cap)
{
    if (prctl(PR_CAPBSET_DROP, (unsigned long)cap, 0, 0, 0) == -1) {
        perror("prctl(PR_CAPBSET_DROP)");
        return -1;
    }
    return 0;
}

/*
 * print_bounding_set() - Print status of selected capabilities in bounding set.
 */
void print_bounding_set(void)
{
    /*
     * We check a representative sample of capabilities.
     * In a real program you would check all capabilities from 0 to CAP_LAST_CAP.
     */
    struct { cap_value_t val; const char *name; } caps_to_check[] = {
        { CAP_SYS_MODULE,        "CAP_SYS_MODULE"        },
        { CAP_SYS_RAWIO,         "CAP_SYS_RAWIO"         },
        { CAP_SYS_TIME,          "CAP_SYS_TIME"          },
        { CAP_NET_RAW,           "CAP_NET_RAW"           },
        { CAP_NET_BIND_SERVICE,  "CAP_NET_BIND_SERVICE"  },
        { CAP_DAC_OVERRIDE,      "CAP_DAC_OVERRIDE"      },
        { CAP_KILL,              "CAP_KILL"              },
        { CAP_SYS_BOOT,          "CAP_SYS_BOOT"          },
    };
    int n = sizeof(caps_to_check) / sizeof(caps_to_check[0]);

    printf("  %-30s  %s\n", "Capability", "In Bounding Set?");
    printf("  %-30s  %s\n", "----------", "----------------");

    for (int i = 0; i < n; i++) {
        int result = is_in_bounding_set(caps_to_check[i].val);
        printf("  %-30s  %s\n",
               caps_to_check[i].name,
               (result == 1) ? "YES" : (result == 0) ? "NO" : "ERROR");
    }
}

int main(void)
{
    printf("=== Capability Bounding Set Demo ===\n");
    printf("PID=%d  UID=%d  EUID=%d\n\n",
           (int)getpid(), (int)getuid(), (int)geteuid());

    if (geteuid() != 0) {
        printf("WARNING: Not running as root. Cannot drop from bounding set.\n");
        printf("(PR_CAPBSET_READ still works for reading)\n\n");
    }

    /*
     * Step 1: Show the bounding set BEFORE any drops.
     * On a default system, all capabilities should be present.
     */
    printf("--- BEFORE dropping capabilities ---\n");
    print_bounding_set();

    if (geteuid() != 0) {
        printf("\nRun as root to see the drop demonstration.\n");
        return 0;
    }

    /*
     * Step 2: Drop dangerous capabilities from the bounding set.
     *
     * A real security-hardened daemon would drop all capabilities
     * that it will never need, before forking worker processes.
     * This ensures no descendant can ever gain these capabilities,
     * even by execing a file that has them set.
     *
     * We drop:
     *   CAP_SYS_MODULE — prevents loading kernel modules
     *   CAP_SYS_RAWIO  — prevents direct hardware I/O access
     *   CAP_SYS_BOOT   — prevents system reboot
     */
    printf("\n--- Dropping CAP_SYS_MODULE, CAP_SYS_RAWIO, CAP_SYS_BOOT ---\n");
    printf("(This is IRREVERSIBLE for this process and all descendants)\n\n");

    if (drop_from_bounding_set(CAP_SYS_MODULE) == 0)
        printf("  Dropped CAP_SYS_MODULE from bounding set.\n");

    if (drop_from_bounding_set(CAP_SYS_RAWIO) == 0)
        printf("  Dropped CAP_SYS_RAWIO from bounding set.\n");

    if (drop_from_bounding_set(CAP_SYS_BOOT) == 0)
        printf("  Dropped CAP_SYS_BOOT from bounding set.\n");

    /*
     * Step 3: Show the bounding set AFTER drops.
     * The three dropped capabilities should now show "NO".
     */
    printf("\n--- AFTER dropping capabilities ---\n");
    print_bounding_set();

    /*
     * Step 4: Try to add a capability back to the bounding set.
     * There is NO prctl operation for this — it is impossible.
     * Once dropped, it's gone from this process and all descendants.
     *
     * The only way to get it back would be to exec() a new process
     * hierarchy (not from a descendant of this process).
     */
    printf("\n--- Attempting to restore CAP_SYS_MODULE (should fail) ---\n");
    printf("  There is no prctl() operation to add to the bounding set.\n");
    printf("  PR_CAPBSET_DROP exists, but there is no PR_CAPBSET_ADD.\n");
    printf("  The drop is permanent for this process and all its children.\n");

    printf("\n=== Done ===\n");
    return 0;
}

--- BEFORE dropping capabilities ---
  CAP_SYS_MODULE                  YES
  CAP_SYS_RAWIO                   YES
  CAP_SYS_TIME                    YES
  CAP_NET_RAW                     YES
  ...

--- Dropping CAP_SYS_MODULE, CAP_SYS_RAWIO, CAP_SYS_BOOT ---
  Dropped CAP_SYS_MODULE from bounding set.
  Dropped CAP_SYS_RAWIO from bounding set.
  Dropped CAP_SYS_BOOT from bounding set.

--- AFTER dropping capabilities ---
  CAP_SYS_MODULE                  NO
  CAP_SYS_RAWIO                   NO
  CAP_SYS_TIME                    YES
  ...