Linux capabilities
kernel-featureopen sourceThe kernel's split of root's monolithic power into ~40 discrete privileges that can be granted or dropped individually.
documentedman7: capabilities(7) ↗
Linux capabilities break the all-or-nothing power of UID 0 into distinct units, CAP_NET_ADMIN, CAP_SYS_ADMIN, CAP_MKNOD, and so on, that can be granted or dropped per process. Container runtimes drop most capabilities from a container by default, so a root process inside cannot load kernel modules, change the clock, or mount arbitrary filesystems. Dropping capabilities (especially CAP_SYS_ADMIN) is a core container-hardening lever.
Strengths
- Fine-grained: drop dangerous privileges while keeping root's useful ones
- Container runtimes drop most caps by default, shrinking attack surface
- Composes with seccomp, namespaces, and LSMs
Limitations
- A few capabilities (notably CAP_SYS_ADMIN) are near-equivalent to full root
- Adding caps back, or running --privileged, reopens host escape
- Shared kernel, capabilities do not survive a kernel LPE