Can you explain what capabilities in Linux are and how they work?

Capabilities in Linux are a mechanism that allows splitting the superuser (root) privileges into smaller, independent privileges. This helps enhance security by granting processes only the rights they actually need, instead of full root access.

For example, instead of running a process with full root rights, you can give it capabilities to open network sockets or change system time.

Main points:

• Capabilities are divided into sets: Effective, Permitted, Inheritable, and Bounding.
• Programs can be launched with specific capabilities, which limits their abilities.
• This reduces the risk of system compromise when exploiting vulnerabilities.

To view the capabilities of a file, you can use the command:

getcap /path/to/binary

And to set capabilities:

setcap cap_net_bind_service=+ep /path/to/binary

This allows the program to open ports below 1024 without running as root.