CAPABILITY.CONF(5)

💖 capability.conf 💖

the pam_cap module configuration file — straight out of the File Formats Manual, bestie 🎀

---

✨ NAME ✨

capability.conf — okay so this is literally the configuration file for the pam_cap module. that's it, that's the whole job. iconic. 👑

---

🦋 SYNOPSIS 🦋

/etc/security/capability.conf

one file. one path. she's lowkey famous. 💅

---

🌸 DESCRIPTION 🌸

so the syntax for lines in this config file goes a little something like this, no cap:

# <-- ´#´ precedes a comment

<IAB><SPACE><WHO>

quick vibe check on the pieces:

• <IAB> is the text format for an inheritable IAB capability tuple — go peek at cap_text_formats(7) if you need the lore — or you can just use the words all or none. 🫶
• the reserved word all does not grant all the inheritable capabilities. not even close, bestie. it just acts as a simple pass-through for any prevailing IAB tuple capabilities. it's giving "i'm not doing anything, i'm just letting you through." 💀
• the reserved word none refers to an empty Inheritable capability set — and by extension, an empty Ambient vector. literally nothing. an empty plate. 🍽️
• <WHO> is the space separated PAM username values that are gonna get granted that IAB tuple you specified. a name prefixed with @ refers to the locally defined /etc/group etc users listed under that group name. and an asterisk * can be used to denote all users. ⭐

the tea on parsing: the parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that. no second chances, no fallbacks. first match wins, periodt. 🔥

Examples of valid syntax are:

    # only root gets to keep what it had
    all                                root

    # this should fire for user beta only, who will have
    # cap_chown dropped from their bounding set.
    !cap_chown                         beta

    # the next one should snag the members of the ´three´ group
    # granting them cap_setuid and cap_chown
    cap_setuid,cap_chown               @three

    # this would apply to beta and gamma, but beta is already
    # granted a lack of cap_chown above. Further, if gamma is
    # in the ´three´ group, it would not reach this line.
    cap_chown                          beta gamma

    # members of the ´one´ group are granted the cap_setuid Inheritable
    # capability, but cap_chown is dropped from their bounding set.
    !cap_chown,cap_setuid              @one

    # user alpha gets an ambient capability (unless it is also
    # a member of the groups ´one´ or ´three´).
    ^cap_setuid                        alpha

    # user delta (if not a member of groups ´one´ and ´three´) will get
    # cap_chown and cap_setgid Ambient capabilities, but have cap_setuid
    # dropped from its bounding set.
    ^cap_chown,^cap_setgid,!cap_setuid delta

    # any remaining members of group ´four´ will get the cap_setuid
    # Inheritable capability.
    cap_setuid                         @four

see how beta gets snagged by the !cap_chown line before the cap_chown beta gamma line even gets a chance? that's the first-match-wins energy right there. and gamma in the ´three´ group never reaches it either. so rude. so correct. 💅

---

👑 SEE ALSO 👑

• pam_cap(8)
• cap_iab(3)
• cap_text_formats(7)

---

okay that's the whole page, bestie!! 🩷 this was CAPABILITY.CONF(5) from the File Formats Manual, dated 2025-03-19. go forth and configure your capabilities responsibly. mwah. 💋✨