POSIX capabilities
/ PAH-ziks /
Traditionally a Unix process is either 'root' — allowed to do absolutely everything — or an ordinary user with almost no special powers. That is an all-or-nothing key: a program that needs just ONE privileged ability (say, binding to port 80) has to run as full root, and if it is hijacked the attacker inherits ALL of root's powers. POSIX capabilities break root's monolithic power into many small, separately grantable privileges, so a program can hold exactly the one it needs and nothing more.
Concretely, the kernel defines a few dozen named capabilities, each unlocking one class of privileged operation. CAP_NET_BIND_SERVICE permits binding to ports below 1024; CAP_NET_RAW permits raw sockets; CAP_SYS_ADMIN is a broad, dangerous one covering many admin operations; CAP_DAC_OVERRIDE bypasses file permission checks; CAP_CHOWN allows changing file ownership. Each process carries capability sets (permitted, effective, inheritable, and a bounding set that caps what can ever be gained). A privileged operation in the kernel checks for a SPECIFIC capability rather than for uid 0. So a web server can be given only CAP_NET_BIND_SERVICE, drop everything else, and then — even if exploited — the attacker cannot, for instance, load a kernel module or read arbitrary files, because those require capabilities the process does not hold. Dropping privilege early and keeping only the minimum is least privilege in action.
It matters for hardening daemons and is the foundation under containers (a container is typically given a restricted capability set, which is a big part of why it is weaker than full root on the host). The honest caveats: capabilities are coarser and leakier than they look. CAP_SYS_ADMIN is so broad it has been called 'the new root', and several capabilities can be parlayed into full root by an attacker who understands the kernel. So capabilities reduce, but do not always cleanly bound, the blast radius; they are most effective combined with seccomp, namespaces, and dropping the capability the moment it is no longer needed.
# grant just one privilege to a binary instead of running it as root: $ sudo setcap cap_net_bind_service=+ep ./webserver $ ./webserver # can bind port 80, but cannot load modules, chown, etc. # in C, drop the rest early: cap_set_proc(...) keeping only what is needed
The server gets exactly the one capability it needs; a later compromise cannot reach privileges it never held.
Capabilities split root but imperfectly: CAP_SYS_ADMIN is so broad it is nearly root, and several capabilities can be escalated to full root — they shrink the blast radius rather than guarantee a hard boundary.