Linux File Capabilities (getcap/setcap)

Linux file capabilities are a fine-grained alternative to the all-or-nothing SUID bit: instead of granting a binary every root privilege, capabilities grant specific ones — CAP_NET_RAW for raw sockets, CAP_SETUID for arbitrary UID changes, CAP_DAC_OVERRIDE to bypass file permission checks, and so on. They are stored as extended attributes on the file, so they are invisible to ls -l SUID audits — a separate enumeration step is required.

Enumeration

# Show capabilities on one binary
getcap /usr/bin/ping
 
# Recursively scan a tree; silence permission errors
getcap -r / 2>/dev/null
getcap -r /usr 2>/dev/null

getcap(8) prints entries like /usr/bin/ping cap_net_raw=ep — the =ep suffix means the capability is in the effective and permitted sets (live at exec, no separate raise call needed).

Why capabilities matter for privesc

Capabilities are not the SUID permission and are missed by find / -perm -4000 (see unix-permissions). Several are effectively root-equivalent when present on an abusable binary:

Capability	Privesc angle
CAP_SETUID	Call setuid(0) — interpreters (python, perl, ruby) with this cap are instant root
CAP_DAC_OVERRIDE / CAP_DAC_READ_SEARCH	Read/write any file — /etc/shadow, SSH keys (etc-shadow-weak-permissions without the misconfiguration)
CAP_SYS_PTRACE	Inject into any process — hijack a root process’s memory
CAP_SYS_ADMIN	The “new root” — mount, namespaces, and dozens of other operations
CAP_NET_RAW	Packet crafting/sniffing — usually not directly root, but useful for credential capture

Example — Python with cap_setuid:

/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

GTFOBins catalogs per-binary capability escapes alongside the SUID and sudo variants.

Defense

• Audit with getcap -r on a schedule; file capabilities survive package updates that wouldn’t normally reset them.
• Strip unnecessary caps: setcap -r /path/to/binary.
• The bounding set (/proc/sys/kernel/cap-bound) and no_new_privs constrain what even a capable binary can obtain.

Sources

• capabilities(7) — Linux manual page
• getcap(8) — Linux manual page
• setcap(8) — Linux manual page

Related: unix-permissions, suid-shell-executable, find-command, sudo-nopasswd-recon