capsh(1)
Display or work with POSIX capability sets for the current process or check capability support.
Synopsis
capsh [OPTION]... [--] [COMMAND [ARG]...]Description
capsh is a utility for examining and modifying POSIX 1003.1e capabilities. It can display the capability set of the current process, check whether the kernel and libc support capabilities, or run a program with modified capability sets.
Capabilities are a set of discrete privileges that can be granted to processes to perform privileged operations without requiring full root access. capsh helps manage these fine-grained permissions and is useful for security auditing and privilege escalation control.
Common options
| Flag | What it does |
|---|---|
--print | Display the capabilities of the current process in human-readable format |
--decode=CAP | Decode a numeric capability value into its name (e.g., 0=CAP_CHOWN) |
--supports=CAP | Check if the kernel supports a specific capability (exit 0 if supported) |
--drop=CAP | Drop (remove) a capability before executing a command |
--keep=CAP | Keep only the specified capability; drop all others |
--inh=CAP | Set the inheritable capability set |
--caps=CAP | Set both effective and permitted capability sets |
--quiet | Suppress output; useful for checking support without printing |
--help | Display help message and exit |
Examples
Show all capabilities of the current process in readable format
capsh --printCheck if CAP_NET_BIND_SERVICE is supported by the kernel (exit status indicates result)
capsh --supports=cap_net_bind_serviceRun the whoami command with CAP_SYS_ADMIN capability removed
capsh --drop=cap_sys_admin -- /usr/bin/whoamiLaunch a bash shell with only CAP_NET_BIND_SERVICE and CAP_SETUID capabilities
capsh --keep=cap_net_bind_service,cap_setuid -- bashDecode numeric capability 0 to show it equals CAP_CHOWN
capsh --decode=0Run a Python server with only CAP_NET_BIND_SERVICE effective and permitted
capsh --caps=cap_net_bind_service -- python3 server.pySilently check capability support; print message only if supported
capsh --quiet && echo 'Capabilities supported'