> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/identification-authentication-and-authorization/linux-security-mechanisms/file-capabilities.md).

# File capabilities

Stored in the `security.capability` attribute.

Specify capabilities for threads that exec a file.

* Permitted set.
  * Immediately forced into the permitted set.
  * Previous AND with the thread’s bounding set.
* Inheritable set.
  * To AND with the threads’ inheritable set.
  * Can be used to reduce the effective set upon the exec.
* Effective bit.
  * Enforce all new capabilities into the thread’s effective set.