The securebits mechanism is a set of per-process (technically per-thread) flags that control each of the three special root treatments described in the chapter. These flags exist in pairs: a base flag that controls behavior, and a corresponding locked flag that prevents the base flag from being changed again.

Inheritance behavior:

• Securebits flags are inherited by child processes created via fork().
• All flags are preserved across exec(), except SECBIT_KEEP_CAPS, which is cleared on exec() (for historical compatibility with the older prctl(PR_SET_KEEPCAPS) operation).
• Modifying securebits flags requires CAP_SETPCAP in the process’s effective set.
• A process reads its securebits with prctl(PR_GET_SECUREBITS).
• A process sets its securebits with prctl(PR_SET_SECUREBITS, flags).

To make a process and all its descendants operate in a pure capability model (where root’s UID has no special meaning), you can call:

After this call:

• UID transitions no longer affect capabilities (SECBIT_NO_SETUID_FIXUP)
• Root gets no automatic capability grants from exec (SECBIT_NOROOT)
• Both flags are permanently locked — even a process with CAP_SETPCAP cannot undo them (LOCKED flags)
• The only way for this process or its descendants to gain capabilities is through file capabilities on executed programs

Before you can use setcap to assign file capabilities, you need to know which capabilities a program actually requires. This is a non-trivial problem, especially for binary-only programs or large codebases. There are two main approaches:

File capabilities were not available before Linux 2.6.24. Systems running older kernels (or newer kernels built without CONFIG_SECURITY_FILE_CAPABILITIES) behave differently in several important ways.

CAP_SETPCAP on older kernels: The capability theoretically allows a process to change other processes’ capabilities. However, the system-wide bounding set always masks out CAP_SETPCAP, making this impossible in practice. The bounding set is initialized as –257 in two’s complement representation, which means all bits are set except bit 8 (CAP_SETPCAP has the value 8).

This program demonstrates how to use the securebits mechanism to create a pure capability-based environment. It sets the necessary flags to disable root’s special treatment, then forks a child to show that the flags are inherited.

/*
 * securebits_demo.c
 *
 * Demonstrates the securebits mechanism for creating a pure
 * capability-based environment where UID 0 gets no special treatment.
 *
 * Must run as root (needs CAP_SETPCAP to modify securebits).
 *
 * Compile:
 *   gcc -o securebits_demo securebits_demo.c -lcap
 *
 * Run:
 *   sudo ./securebits_demo
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/prctl.h>
#include <sys/capability.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <linux/securebits.h>

/*
 * print_securebits() - Display the current securebits flags.
 * Uses prctl(PR_GET_SECUREBITS) to read the flags.
 */
static void print_securebits(const char *label)
{
    int bits;

    bits = prctl(PR_GET_SECUREBITS);
    if (bits == -1) {
        perror("prctl(PR_GET_SECUREBITS)");
        return;
    }

    printf("  [%s] Securebits=0x%x\n", label, bits);
    printf("    SECBIT_KEEP_CAPS:              %s\n",
           (bits & SECBIT_KEEP_CAPS) ? "SET" : "clear");
    printf("    SECBIT_NO_SETUID_FIXUP:        %s\n",
           (bits & SECBIT_NO_SETUID_FIXUP) ? "SET" : "clear");
    printf("    SECBIT_NOROOT:                 %s\n",
           (bits & SECBIT_NOROOT) ? "SET" : "clear");
    printf("    SECBIT_NO_SETUID_FIXUP_LOCKED: %s\n",
           (bits & SECBIT_NO_SETUID_FIXUP_LOCKED) ? "SET (locked)" : "clear");
    printf("    SECBIT_NOROOT_LOCKED:          %s\n",
           (bits & SECBIT_NOROOT_LOCKED) ? "SET (locked)" : "clear");
    printf("\n");
}

/*
 * print_caps() - Print brief capability state
 */
static void print_caps(const char *label)
{
    cap_t caps = cap_get_proc();
    char *text = caps ? cap_to_text(caps, NULL) : NULL;
    printf("  [%s] caps=[%s]  RUID=%d EUID=%d\n",
           label, text ? text : "?",
           (int)getuid(), (int)geteuid());
    if (text) cap_free(text);
    if (caps) cap_free(caps);
}

int main(void)
{
    pid_t child_pid;

    printf("=== Securebits Mechanism Demo ===\n\n");

    if (geteuid() != 0) {
        fprintf(stderr, "Must run as root. Try: sudo ./securebits_demo\n");
        return 1;
    }

    /* --- Step 1: Show initial state --- */
    printf("--- Initial state ---\n");
    print_securebits("Before");
    print_caps("Before");

    /* --- Step 2: Set securebits to create pure capability environment ---
     *
     * We set four flags:
     *
     * SECBIT_NOROOT:
     *   Root no longer gets automatic capabilities during exec().
     *   A root process execing a program gets no capabilities unless
     *   the file has explicit file capabilities set.
     *
     * SECBIT_NOROOT_LOCKED:
     *   Lock SECBIT_NOROOT permanently. Even CAP_SETPCAP cannot undo it.
     *
     * SECBIT_NO_SETUID_FIXUP:
     *   UID transitions (0<->nonzero) no longer affect capabilities.
     *   Capabilities are fully orthogonal to UIDs.
     *
     * SECBIT_NO_SETUID_FIXUP_LOCKED:
     *   Lock SECBIT_NO_SETUID_FIXUP permanently.
     *
     * After this call, this process and ALL its descendants operate in
     * a pure capability-based model. Capabilities come only from file
     * capabilities — root UID provides no special treatment.
     *
     * prctl(PR_SET_SECUREBITS) requires CAP_SETPCAP in effective set.
     */
    printf("--- Setting NOROOT + NO_SETUID_FIXUP (and locking both) ---\n");

    if (prctl(PR_SET_SECUREBITS,
              SECBIT_NOROOT | SECBIT_NOROOT_LOCKED |
              SECBIT_NO_SETUID_FIXUP | SECBIT_NO_SETUID_FIXUP_LOCKED) == -1) {
        perror("prctl(PR_SET_SECUREBITS)");
        return 1;
    }

    print_securebits("After setting securebits");
    print_caps("After setting securebits");

    /* --- Step 3: Verify that UID transitions no longer affect capabilities ---
     *
     * With SECBIT_NO_SETUID_FIXUP set, changing EUID from 0 to nonzero
     * should NOT clear the effective capability set (contrast with Section 39.6
     * where it normally would).
     */
    printf("--- Testing: seteuid(1000) should NOT affect capabilities now ---\n");

    if (seteuid(1000) == -1) {
        perror("seteuid(1000)");
    } else {
        print_caps("After seteuid(1000) with NO_SETUID_FIXUP");
        printf("  (Capabilities unchanged — SECBIT_NO_SETUID_FIXUP is working)\n\n");
        seteuid(0);  /* Restore root EUID */
    }

    /* --- Step 4: Fork to show child inherits securebits ---
     *
     * A child process created via fork() inherits the securebits flags.
     * The pure capability environment propagates to all descendants.
     */
    printf("--- Forking child to show securebits inheritance ---\n");

    child_pid = fork();
    if (child_pid == -1) {
        perror("fork");
        return 1;
    }

    if (child_pid == 0) {
        /* Child process */
        printf("  [Child PID=%d] Inherited securebits from parent:\n",
               (int)getpid());
        print_securebits("Child");

        /* Child cannot change securebits because locked flags prevent it */
        printf("  [Child] Attempting to clear SECBIT_NOROOT (should fail — locked):\n");
        if (prctl(PR_SET_SECUREBITS, 0) == -1) {
            printf("  [Child] prctl failed as expected: %m\n");
            printf("  [Child] Locked securebits cannot be changed.\n");
        } else {
            printf("  [Child] Unexpectedly succeeded in clearing securebits.\n");
        }
        exit(0);
    } else {
        /* Parent waits for child */
        int status;
        waitpid(child_pid, &status, 0);
    }

    printf("\n=== Demo complete. Pure capability environment established. ===\n");
    printf("Any program run from this process can only gain capabilities\n");
    printf("via explicit file capabilities (setcap), never via root UID.\n");

    return 0;
}

--- Initial state ---
  [Before] Securebits=0x0
    SECBIT_KEEP_CAPS:              clear
    SECBIT_NO_SETUID_FIXUP:        clear
    SECBIT_NOROOT:                 clear

--- Setting NOROOT + NO_SETUID_FIXUP ---
  [After setting securebits] Securebits=0x2a
    SECBIT_NO_SETUID_FIXUP:        SET
    SECBIT_NOROOT:                 SET
    SECBIT_NO_SETUID_FIXUP_LOCKED: SET (locked)
    SECBIT_NOROOT_LOCKED:          SET (locked)

--- Testing: seteuid(1000) should NOT affect capabilities now ---
  [After seteuid(1000) with NO_SETUID_FIXUP] caps=[=ep]  RUID=0 EUID=1000
  (Capabilities unchanged — SECBIT_NO_SETUID_FIXUP is working)

--- Forking child ---
  [Child] prctl failed as expected: Operation not permitted
  [Child] Locked securebits cannot be changed.

The Linux capabilities scheme replaces the coarse-grained all-or-nothing UNIX privilege model with around 40 distinct capability units. Key points to remember:

• Each process has three capability sets: permitted (ceiling), effective (active), and inheritable (for exec propagation).
• Each file can have three capability sets: permitted (forced grants), effective (single bit for dumb programs), and inheritable (filter for process inheritable).
• The exec() formula precisely defines how process and file sets combine to produce new capabilities.
• The capability bounding set is a per-process security limit that can only shrink, never grow.
• The kernel automatically adjusts capabilities during UID transitions to maintain backward compatibility.
• The libcap API (cap_get_proc, cap_set_flag, cap_set_proc, cap_free) is the correct way to manipulate capabilities in C programs.
• The securebits mechanism allows creating pure capability environments where root UID has no special meaning.
• File capabilities were introduced in Linux 2.6.24. Before that, capabilities could only be used with set-user-ID-root programs using the libcap API to selectively raise and drop them.