GETCAP(8)

💖 getcap 💖

okay bestie, this is the manual page for getcap, the System Manager's Manual entry, and it's giving "check your file's powers" energy 🔍✨

✨ NAME ✨

getcap — examine file capabilities 🦋

🌸 SYNOPSIS 🌸

getcap [-v] [-n] [-r] [-h] filename [ ... ]

💅 DESCRIPTION 💅

okay so getcap is the tool that shows you the name and capabilities of each file you hand it. literally just point it at a file and it spills the tea on what powers that file has 🫶

🎀 OPTIONS 🎀

• -h — prints quick usage 🍓
• -n — prints any non-zero user namespace root user ID value that's attached to a file's capabilities 🧚
• -r — turns on recursive search 🌈
• -v — displays all the searched entries, even the ones that have no file-capabilities 👀
• filename — one file per line 📄

⚠️ NOTE: an empty value of = is NOT the same as an omitted (or removed) capability on a file, bestie. this matters most for the Ambient capability vector 😭 a process with Ambient capabilities will lose them when it executes a file that has = capabilities, but it will keep the Ambient inheritance of privilege when it executes a file with an omitted file capability. so this special empty setting can be used to stop a binary from running with privilege 🔒 the kernel honored this suppression for root executing the file for a while, but after a number of years the kernel developers decided this was unexpected for the superuser and reverted it just for that user identity 💀 suppression of root privilege for a process tree is still possible using the --mode option of capsh(1) 🙈

🫶 REPORTING BUGS 🫶

ngl if something's broken, report it here, periodt 💜

https://bugzilla.kernel.org/buglist.cgi?component=libcap&list_id=1090757

🌈 SEE ALSO 🌈

capsh(1), cap_get_file(3), cap_to_text(3), capabilities(7), user_namespaces(7), captree(8), getpcaps(8) and setcap(8) ✨

that's the whole tea, bestie! 🎀 it's the 2021-08-29 GETCAP(8) page from the System Manager's Manual, and you're literally iconic for reading it 👑💖