Hands-On System Programming with Linux

File capability sets

At times, we require the ability to "embed" capabilities into a binary-executable file (the discussion regarding the reasons for this is covered in the following section). This will obviously require kernel filesystem support. In early Linux, this system was a kernel-configurable option; from Linux kernel 2.6.33, file capabilities are always compiled into the kernel, and are therefore always present.

File capsets are a powerful security feature—you could say they are the modern equivalent of the older set[u|g]id features. To use them in the first place, the OS must support them, and the process (or thread) requires the CAP_FSETCAP capability. Here is the key point: The (previous) thread capsets along with the (coming) ...