The getcap(8) utility can be used to look up the capabilities embedded in a (binary) file. As a quick example lets run getcap on the shell program and the ping utility:
$ getcap /bin/bash$ getcap /usr/bin/ping/usr/bin/ping = cap_net_admin,cap_net_raw+p$
It's clear that bash does not have any file capsets—that's exactly what we expect. Ping, on the other hand, does, so that it can carry out its duties without requiring root privilege.
The getcap utility usage is amply demonstrated via a bash script (similar to the one we saw in the previous chapter): ch8/show_caps.sh. Run it to see various file capability embedded programs installed on the system (left as a simple exercise for the reader to try out).
Similar in ...
