capability
also: Linux capabilities, POSIX.1e capabilities, CAP_*
A fine-grained permission that grants a process a specific privileged action, allowing non-root users to perform tasks that normally require root access without full superuser rights.
Linux capabilities break down the traditional all-or-nothing superuser model into discrete privileges. Instead of giving a process full root access, you can grant only the specific capabilities it needs—such as binding to low-numbered ports, modifying network settings, or reading arbitrary files.
Capabilities are managed per-process and can be set on executable files using tools like setcap. For example, the ping command needs CAP_NET_RAW to send raw network packets, so it can run without being setuid root: setcap cap_net_raw=ep /bin/ping
The kernel enforces capabilities during system calls. When a process attempts a privileged operation, the kernel checks if it has the required capability rather than checking if the effective user ID is zero. This significantly improves security by limiting the damage a compromised process can do.