Linux Capabilities.

A Linux kernel feature defined by POSIX.1e draft that splits the all-powerful root privilege into 40-plus discrete capabilities granted independently to processes and files. It belongs to the Identity & Access category of cybersecurity.

A Linux kernel feature defined by POSIX.1e draft that splits the all-powerful root privilege into 40-plus discrete capabilities granted independently to processes and files.

Linux capabilities were introduced in kernel 2.2 to break the binary divide between unprivileged user and omnipotent root. The kernel exposes about 40 discrete privileges — CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_DAC_OVERRIDE, CAP_SYS_PTRACE, etc. — that can be granted to processes or stamped on executables as file capabilities. They follow the POSIX.1e draft standard. Userspace tools shipped with libcap include capsh (inspect and manipulate a shell's capability set), getcap and setcap (read or assign file capabilities), and getpcaps. Container runtimes such as Docker and containerd grant a default subset (drop CAP_SYS_ADMIN, keep CAP_NET_BIND_SERVICE) and Kubernetes Pod Security Standards restrict them further. Capabilities are foundational for least-privilege design on Linux servers and CNCF-style workloads.

Defences for Linux Capabilities typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: POSIX capabilities, Linux caps.