capable.bt(8)

📦
version 0.27.0 · 4 versions
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

💅 capable.bt(8) — the vibe check for kernel capability checks

okay bestie, pull up a chair because this is from the System Manager's Manual and it's genuinely iconic. welcome to capable.bt, section 8, the one and only. 🫶

✨ NAME ✨

capable.bt — trace security capability checks, aka cap_capable(). that's it, that's the whole job, and she does it flawlessly. 💖

🌸 SYNOPSIS 🌸

capable.bt

no flags, no arguments, no drama. she just goes. periodt.

🦋 DESCRIPTION 🦋

so basically this traces security capability checks inside the kernel and prints the deets for every single call. it's giving observability. it's giving receipts.

it's lowkey useful for general debugging, and highkey useful for security enforcement — like, you can literally figure out a white list of the capabilities an application actually needs. yes bestie, we're doing least privilege today. 👑

⚠️ and because this uses BPF, only the root user can run this tool. sorry to the non-root girlies, that's just the rules. 💀

🎀 REQUIREMENTS 🎀

  • CONFIG_BPF
  • bpftrace

that's the whole list. go check them before you come crying to me. 😭

🔥 EXAMPLES 🔥

trace all capability checks system-wide, chef's kiss, no filter, main character energy:

# capable.bt

⭐ FIELDS ⭐

every column, explained, because i love you:

  • TIME(s) — time of the capability check, formatted HH:MM:SS.
  • UID — user ID.
  • PID — process ID.
  • COMM — process name.
  • CAP — capability number.
  • NAME — capability name. peep capabilities(7) for descriptions, iykyk.
  • AUDIT — whether this was an audit event.

🧚 OVERHEAD 🧚

this adds low-overhead instrumentation to capability checks, and capability checks are expected to be low frequency… however, that depends on the application. so like, it could be a chill vibe or it could be a lot. don't guess.

🚨 test in a lab environment before use. fr fr. not in prod, bestie, i'm begging you.

💜 SOURCE 💜

this one's from bpftrace:

https://github.com/bpftrace/bpftrace

also, look in the bpftrace distribution for a companion _examples.txt file — it's got example usage, output, and commentary for this tool. free lore. 📖✨

and plot twist: this is a bpftrace version of the bcc tool of the same name. the bcc tool provides options to customize the output, so if you want knobs to twiddle, that's your girl:

https://github.com/iovisor/bcc

🌈 OS 🌈

Linux — as always. 🐧

🙈 STABILITY 🙈

Unstable - in development. she's still growing, she's still evolving, treat her with grace. 💅

👑 AUTHOR 👑

Brendan Gregg — absolute legend, we stan.

🌸 SEE ALSO 🌸

okay that's the whole page, you're officially educated, go trace something and slay. 💖

this cutie came out of USER COMMANDS and was dated 2018-09-08, and it lives at capable.bt(8) — mwah, bye bestie! 🎀✨

📦 where this page comes from