Quick answer

Linux capabilities break the all-or-nothing power of root into discrete units (like CAP_NET_RAW or CAP_SETUID) that can be granted to a binary without making it fully SUID-root. A binary with the wrong capability can be as dangerous as SUID-root.

What is Linux capabilities?#

Instead of a program being root or not, capabilities let it hold specific privileges. For example CAP_NET_BIND_SERVICE lets a non-root program bind low ports. File capabilities are set with setcap and viewed with getcap.

Why LinPEAS checks linux capabilities#

LinPEAS enumerates file capabilities across the filesystem and users with capabilities, because a dangerous capability on an unexpected binary is a direct privilege-escalation path that plain SUID checks would miss.

What a normal configuration looks like#

A few binaries legitimately carry capabilities (e.g. ping may hold CAP_NET_RAW). These are limited and specific.

Why it can be security-sensitive#

Escalation-grade capabilities include CAP_SETUID/CAP_SETGID (change UID to 0), CAP_DAC_READ_SEARCH (read any file), CAP_DAC_OVERRIDE (write any file), CAP_SYS_ADMIN (broad), CAP_SYS_PTRACE (inspect other processes), and CAP_SYS_MODULE (load kernel modules). On an interpreter such as python or perl, several of these mean instant root.

From highlight to verdict

Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

Find file capabilities
getcap -r / 2>/dev/null
Show a specific file's capabilities
getcap /usr/bin/ping
Check your process's capabilities
capsh --print 2>/dev/null; cat /proc/self/status | grep Cap

Defensive remediation#

  • Remove unneeded capabilities: setcap -r <file>.
  • Never grant escalation-grade capabilities to interpreters or shells.
  • Prefer the least-powerful capability that meets the need.
  • Baseline capability assignments and alert on new ones.

Sources & references

  1. HackTricks: Linux privilege escalation
  2. GTFOBins — abuse techniques for standard binaries
  3. PEASS-ng repository — reviewed 20260908-dffb9496