getcap

Install

# Provided by libcap package

# RHEL / Alma / Rocky
sudo dnf install libcap

# Debian / Ubuntu
sudo apt install libcap2-bin

# openSUSE
sudo zypper install libcap-progs

# Arch
sudo pacman -S libcap

What it does

getcap shows the capabilities assigned to files. It is commonly used to inspect privileges previously set with setcap.

How it works (mechanical)

• Reads extended file attributes (xattrs).
• Displays capability sets stored in filesystem metadata.
• Does not modify files — read-only inspection.
• Works only on filesystems that support extended attributes.
• Often paired with setcap.

Quick Start

# Show capabilities on a file
getcap /usr/bin/ping

10 Practical Examples

# 1) Inspect a specific binary
getcap /usr/bin/ping

# 2) Recursively scan a directory
getcap -r /usr/bin

# 3) Find all files with capabilities
getcap -r / 2>/dev/null

# 4) Verify capability after setcap
sudo setcap cap_net_bind_service=+ep ./app
getcap ./app

# 5) Combine with grep
getcap -r /usr 2>/dev/null | grep cap_net

# 6) Compare traditional permissions
ls -l /usr/bin/ping

# 7) Inspect custom binary
getcap ./mybinary

# 8) Validate removal of capabilities
sudo setcap -r ./mybinary
getcap ./mybinary

# 9) Redirect output to file
getcap -r /usr > capabilities.txt

# 10) Show help
getcap --help

Notes & Gotchas

• Capabilities do not show in standard ls -l output.
• Files copied without xattr preservation lose capabilities.
• Use getfattr for deeper attribute inspection.
• Security auditing often includes scanning for unexpected capabilities.
• Root not required to view capabilities in most cases.

Historical Context

As Linux capabilities replaced some traditional setuid usage, getcap became essential for auditing and verifying granular privilege assignments.

Modern Equivalent

Capabilities remain part of container and service security models. getcap is widely used in modern Linux systems for security validation.

Related Commands

• setcap — assign file capabilities.
• capsh — inspect process capabilities.
• chmod — change file permissions.
• getfattr — view extended attributes.
• ls — list files and permissions.