>

Audit File Capabilities with getcap

Find every binary granted kernel capabilities — a small attack surface attackers love.

LinuxcapabilitiespermissionssecurityMedium risk
Run sudo getcap -r /usr 2>/dev/null to recursively list every executable in /usr that carries file capabilities.

01Command

Command
$ sudo getcap -r /usr 2>/dev/null

02What it does

File capabilities let individual binaries (ping, tcpdump, Wireshark's dumpcap) perform privileged actions without running as root or being setuid. Because each granted capability is a permanent privilege exception, auditing them with getcap -r is part of a good hardening routine. You should typically only see a handful of system binaries plus anything you deliberately granted with setcap.

03Risk

RiskMedium risk
Requirementslibcap package (getcap/setcap)

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • capabilities(7) — man7.org
    man7.org · community · 2026-09-17
    Evidence: capabilities(7) explains file capability sets and the xattr mechanism used by getcap/setcap, e.g. cap_net_raw
  • getcap(8) — Debian manpage
    Debian · community · 2026-09-17
    Evidence: Debian manpage documents getcap with -r recursive search of directories for files with file capabilities

Last verified: 2026-09-19 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)
LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17
Change file permissions with chmod
LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17
Allow a port through the firewall with ufw
Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17