← Back to Labs
Linux Capability Transition Lab
Track thread sets, file xattrs, bounding masks, ambient carry, namespace scope, and the final allow or deny result.
Thread before exec or check
Live credential sets on the calling thread.
Permitted
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
Effective
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
Inheritable
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
Bounding
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
Ambient
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
Executable or helper in the path
/usr/local/bin/web (plain ELF) · unprivileged file
File permitted
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
File inheritable
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
File effective bit
disabledResult after the kernel decides
Capability gate passes, but the envelope is much wider than the job.
New permitted
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
New effective
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
New ambient
NET_BIND_SERVICENET_RAWSETPCAPSYS_ADMINSYS_MODULESYS_PTRACE
Syscall or transition
bind(:443)
Namespace scope
initial user namespace
Step 1 / 7A broad root-like thread has far more power than the port bind needs
The process can bind 443 now, but it is also still carrying unrelated powers such as raw sockets and system administration. Capabilities are useful only if you narrow them.
Arrow keys to navigate · R to reset
Tap dots to jump to any step