Using setcap in linux

Question

To add the cap_net_raw capability to (for eg /bin/ping), we use the following:

#setcap cap_net_raw=ep /bin/ping

What is the meaning of ep and why is it required here ?

Answer 1

This sets the CAP_NET_RAW bit in both the "effective" (e) and "permitted" (p) capability sets. These two sets, along with the "inheritable" set, govern the capabilities that a process has or can set.

See more here:

capabilities - Linux man page

Capability Sets

Each thread has three capability sets containing zero or more of the above capabilities:

Effective - the capabilities used by the kernel to perform permission checks for the thread.

Permitted - the capabilities that the thread may assume (i.e., a limiting superset for the effective and inheritable sets). If a thread drops a capability from its permitted set, it can never re-acquire that capability (unless it exec()s a set-user-ID-root program).

inheritable - the capabilities preserved across an execve(2). A child created via fork(2) inherits copies of its parent's capability sets. See below for a discussion of the treatment of capabilities during exec(). Using capset(2), a thread may manipulate its own capability sets, or, if it has the CAP_SETPCAP capability, those of a thread in another process.