capset sets the capabilities of a running process.

Examples

capset -pid=1 -capabilities=\!sys_module

capset -pid=1 -add -capabilities=net_raw

Overview

capset [-set|-add|-remove] -pid=pid -capabilities=capability_list

Examples of capability_list:

chown

sys_admin,sys_module

!sysadmin,sys_module

This ! means "all capabilities except." Remember to escape this in a shell command

An empty string means no capabilities. A lone exclamation point (!) means all capabilities.

Minimum unique abbreviation of option is acceptable. You may use double hyphens instead of single hyphen to denote options. You may use white space in place of the equals sign to separate an option name from its value.

General

-set is the default and means to set all three of the process' capabilities sets to the value you indicate with -capabilities.

-add means to add the capabiliites you specify with -capabilities to each of the existing capability sets. Where a capability is already present, there is no change.

-remove is analogous to -add.

Look at /proc/pid/status to see a process' current capabilities.

Permission Needed

All the following permission requirements are imposed by the Linux kernel. capset requests whatever you tell it to request.

Your own permitted capabilities must be a superset of what you are setting and include CAP_SETPCAP. capset is not normally a setuid program.

You cannot make an inheritable capability that is not also a permitted capability.

You cannot make an effective capability that is not also a permitted capability.

Capability Names