PE-CAP
capsh
Capability shell wrapper from libcap, used to inspect and test the Linux capabilities available to a process.
OVERVIEW
capsh is the capability shell wrapper bundled with libcap (git.kernel.org/pub/scm/libs/libcap/libcap.git), the reference userspace library for Linux's POSIX capabilities system — the mechanism that lets a process hold a specific slice of root's power (like binding low ports, or mounting filesystems) without being fully privileged. `capsh --print` is the fastest way to see exactly which capabilities a shell or process currently has, in each of the effective/permitted/inheritable/bounding sets, which is the first thing worth checking after landing in any container or restricted environment.
It also drops capabilities and re-execs a command under the reduced set (`capsh --drop=... -- -c '...'`), which is how you test in practice, rather than in theory, whether a specific overprivileged capability like CAP_SYS_ADMIN, CAP_SYS_PTRACE, or CAP_DAC_OVERRIDE is actually usable for privilege escalation or a container escape from the current context.
USE CASES
Practical use cases
- 01
Printing a process's current capability sets right after landing in a container or restricted shell.
- 02
Confirming whether an overprivileged capability (CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_DAC_OVERRIDE) is actually exploitable from the current context.
- 03
Reproducing a specific privilege-escalation or breakout technique under a controlled, reduced capability set to isolate what is really needed.
- 04
Documenting an over-provisioned container/pod security context (`--cap-add`) for a finding write-up.
QUICK START
Inside a container or on a host, to check exactly which Linux capabilities the current process holds before deciding whether a privilege-escalation path exists.
- Confirm that testing capability-based privilege escalation on this host/container is within the agreed scope.
- Run `capsh --print` to see the current effective, permitted, inheritable, and bounding capability sets.
- Cross-reference any non-default capability against known abuse techniques (e.g. CAP_SYS_ADMIN, CAP_SYS_MODULE).
- Use `capsh --drop=... --` to re-exec under a reduced set and confirm exactly which capability an exploit path depends on.
capsh --printBEFORE YOU RUN IT
What to check before running it
Techniques that use excess capabilities (CAP_SYS_ADMIN in particular) to escape a container reach the underlying host — only exercise them against a host explicitly in scope, not just the container.
A capability being present in the bounding set does not always mean it is usable from the current context (user namespaces and seccomp filters can still block it) — verify before reporting.
capsh itself must be present or transferable into the target container/host; on minimal/distroless images it may need to be run from a mounted or copied static binary.