SETCAP(8)

💅 setcap(8) — bestie edition ✨

okay so this is setcap, from the System Manager's Manual, and it is literally the tool that gives a file its whole capability situation. it's giving "i decide what powers you get" and honestly? iconic. 🎀

---

🌸 NAME 🌸

setcap — set file capabilities 💖

---

✨ SYNOPSIS ✨

setcap [-q] [-n <rootuid>] [-v] {capabilities|-|-r} filename [ ...
capabilitiesN fileN ]

---

🦋 DESCRIPTION 🦋

so like, if you do not pass the -v (verify) option, setcap takes each filename you listed and sets its capabilities to whatever capabilities you told it to. simple. slay.

the optional -n <rootuid> argument? you use it to set the file capability so it only applies inside a user namespace whose root user ID owner is that <rootuid>. very specific, very demure.

the -v option is for verifying — it checks that the capabilities you named are the ones currently associated with the file. and if you hand over both -v and -n, then the -n <rootuid> argument gets verified too. double check, no cap. ✅

the capabilities you're setting get written in the form described over in cap_text_formats(7).

now, the special capability string '-' — that one means "read the capabilities from standard input". and when you do that, the capability set ends with a blank line. periodt.

the special capability string '-r' — that's the one that removes a capability set from a file. 🚨 and listen, this part matters: setting an empty capability set is not the same thing as removing it. an empty set can be used to guarantee that a file is not executed with privilege, even though the prevailing ambient+inheritable sets would otherwise bestow capabilities on executed binaries.

the '-f', is used to force completion even when it's in some way considered an invalid operation. this can affect '-r' and setting file capabilities the kernel will not be able to make sense of. 👀 so like, you're on your own with that one, bestie.

the -q flag is used to make the program less verbose in its output. quieter. mysterious. main character energy. 🤫

---

💀 EXIT CODE 💀

the setcap program will exit with a 0 exit code if successful. on failure, the exit code is 1. that's it, that's the whole vibe check.

---

😭 REPORTING BUGS 😭

please report bugs via:

https://bugzilla.kernel.org/buglist.cgi?component=libcap&list_id=1090757

like actually report them, don't just complain in the group chat 🙈

---

👑 SEE ALSO 👑

capsh(1), cap_from_text(3), cap_get_file(3), cap_text_formats(7), capabilities(7), user_namespaces(7), captree(8), getcap(8) and getpcaps(8).

go read those too, iykyk 🫶

---

and that's the whole page, bestie — this one's from the System Manager's Manual, dated 2025-03-19, and it's SETCAP(8) forever and always. drink water, read your manpages, and don't set capabilities you can't handle 💖✨🌈