Hands-On System Programming with Linux

OS support

Capability bitmask(s) are often referred to as capability sets—we abbreviate this term to capset.

To work with the power of the POSIX capabilities model, in the first place, the OS itself must provide "life support" for it; full support implies the following:

• Whenever a process or thread attempts to perform some operation, the kernel is able to check whether the thread is allowed to do so (by checking for the appropriate bit being set in the thread's effective capset—see the next section).
• System calls (and usually wrapper library APIs) must be provided such that a thread can query and set its capsets.
• Linux kernel filesystem code must have a facility such that capabilities can be embedded (or attached) into a binary-executable ...