Linux Capabilities Calculator

A reference and calculator for the Linux capabilities that split up root's all-or-nothing power into separately grantable pieces. Search or browse below, select the ones you care about, and get the real numeric bitmask, hex form, a setcap command, and systemd CapabilityBoundingSet=/AmbientCapabilities= examples — all computed from the actual kernel bit numbers (verified against this machine's own libcap), not approximated. Descriptions are condensed from the real capabilities(7) man page. Runs entirely in your browser.

A note on scope and stability

Capabilities are added over kernel versions (several here — CAP_BPF, CAP_PERFMON, CAP_CHECKPOINT_RESTORE — only exist since Linux 5.8/5.9) and their exact scope has occasionally changed between kernel releases. This isn't a claim that every capability behaves identically on every kernel you might run — check man 7 capabilities on the actual target system for anything security-critical. CAP_SYS_ADMIN in particular is flagged below as unusually broad: the kernel's own manual page describes it as "overloaded", covering a long tail of loosely-related operations that arguably should have (and increasingly do have, via newer capabilities like CAP_BPF/CAP_PERFMON) their own narrower capability instead.