Enable and disable kernel auditing; change auditing filter rules; retrieve auditing status and filtering rules.

Allow records to be written to kernel auditing log.

Allow arbitrary changes to file UIDs and GIDs (see chown(2)).

Bypass file read, write, and execute permission checks. (DAC = "discretionary access control".)

Bypass file read permission checks and directory read and execute permission checks.

Bypass permission checks on operations that normally require the file system UID of the process to match the UID of the file (e.g., chmod(2), utime(2)), excluding those operations covered by the CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH; set extended file attributes (see chattr(1)) on arbitrary files; set Access Control Lists (ACLs) on arbitrary files; ignore directory sticky bit on file deletion; specify O_NOATIME for arbitrary files in open(2) and fcntl(2).

Don't clear set-user-ID and set-group-ID bits when a file is modified; permit setting of the set-group-ID bit for a file whose GID does not match the file system or any of the supplementary GIDs of the calling process.

Permit memory locking (mlock(2), mlockall(2), mmap(2), shmctl(2)).

Bypass permission checks for operations on System V IPC objects.

Bypass permission checks for sending signals (see kill(2)). This includes use of the KDSIGACCEPT ioctl.

(Linux 2.4 onwards) Allow file leases to be established on arbitrary files (see fcntl(2)).

Allow setting of the EXT2_APPEND_FL and EXT2_IMMUTABLE_FL extended file attributes (see chattr(1)).

(Linux 2.4 onwards) Allow creation of special files using mknod(2).

Allow various network-related operations (e.g., setting privileged socket options, enabling multicasting, interface configuration, modifying routing tables).

Allow binding to Internet domain reserved socket ports (port numbers less than 1024).

(Unused) Allow socket broadcasting, and listening multicasts.

Permit use of RAW and PACKET sockets.

Allow arbitrary manipulations of process GIDs and supplementary GID list; allow forged GID when passing socket credentials via Unix domain sockets.

Grant or remove any capability in the caller's permitted capability set to or from any other process.

Allow arbitrary manipulations of process UIDs (setuid(2), setreuid(2), setresuid(2), setfsuid(2)); allow forged UID when passing socket credentials via Unix domain sockets.

Permit a range of system administration operations including: quotactl(2), mount(2), umount(2), swapon(2), swapoff(2), sethostname(2), setdomainname(2), IPC_SET and IPC_RMID operations on arbitrary System V IPC objects; perform operations on trusted and security Extended Attributes (see attr(5)); call lookup_dcookie(2); use ioprio_set(2) to assign IOPRIO_CLASS_RT and IOPRIO_CLASS_IDLE I/O scheduling classes; perform keyctl(2) KEYCTL_CHOWN and KEYCTL_SETPERM operations. allow forged UID when passing socket credentials; exceed /proc/sys/fs/file-max, the system-wide limit on the number of open files, in system calls that open files (e.g., accept(2), execve(2), open(2), pipe(2); without this capability these system calls will fail with the error ENFILE if this limit is encountered); employ CLONE_NEWNS flag with clone(2) and unshare(2); perform KEYCTL_CHOWN and KEYCTL_SETPERM keyctl(2) operations.

Permit calls to reboot(2) and kexec_load(2).

Permit calls to chroot(2).

Allow loading and unloading of kernel modules; allow modifications to capability bounding set (see init_module(2) and delete_module(2)).

Allow raising process nice value (nice(2), setpriority(2)) and changing of the nice value for arbitrary processes; allow setting of real-time scheduling policies for calling process, and setting scheduling policies and priorities for arbitrary processes (sched_setscheduler(2), sched_setparam(2)); set CPU affinity for arbitrary processes (sched_setaffinity(2)); set I/O scheduling class and priority for arbitrary processes (ioprio_set(2)); allow migrate_pages(2) to be applied to arbitrary processes and allow processes to be migrated to arbitrary nodes; allow move_pages(2) to be applied to arbitrary processes; use the MPOL_MF_MOVE_ALL flag with mbind(2) and move_pages(2).

Permit calls to acct(2).

Allow arbitrary processes to be traced using ptrace(2)

Permit I/O port operations (iopl(2) and ioperm(2)); access /proc/kcore.

Permit: use of reserved space on ext2 file systems; ioctl(2) calls controlling ext3 journaling; disk quota limits to be overridden; resource limits to be increased (see setrlimit(2)); RLIMIT_NPROC resource limit to be overridden; msg_qbytes limit for a message queue to be raised above the limit in /proc/sys/kernel/msgmnb (see msgop(2) and msgctl(2).

Allow modification of system clock (settimeofday(2), stime(2), adjtimex(2)); allow modification of real-time (hardware) clock

Permit calls to vhangup(2).

the capabilities used by the kernel to perform permission checks for the thread.

the capabilities that the thread may assume (i.e., a limiting superset for the effective and inheritable sets). If a thread drops a capability from its permitted set, it can never re-acquire that capability (unless it execve(2)s a set-user-ID-root program).

the capabilities preserved across an execve(2).

this set is ANDed with the thread's inheritable set to determine which inheritable capabilities are permitted to the thread after the execve(2).

the capabilities automatically permitted to the thread, regardless of the thread's inheritable capabilities.

those capabilities in the thread's new permitted set are also to be set in the new effective set. (F(effective) would normally be either all zeroes or all ones.)

denotes the value of a thread capability set before the execve(2)

denotes the value of a capability set after the execve(2)

denotes a file capability set

is the value of the capability bounding set.