capable(8) System Manager's Manual capable(8)

# [NAME](#NAME)

capable - Trace security capability checks (cap\_capable()).

# [SYNOPSIS](#SYNOPSIS)

**capable \[-h] \[-v] \[-p PID] \[-K] \[-U] \[-x] \[--cgroupmap MAPPATH]**  
\[--mntnsmap MAPPATH] \[--unique]

# [DESCRIPTION](#DESCRIPTION)

This traces security capability checks in the kernel, and prints details for each call. This can be useful for general debugging, and also security enforcement: determining a white list of capabilities an application needs.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF, bcc.

# [OPTIONS](#OPTIONS)

-h USAGE message.

[-v](#v)

Include non-audit capability checks. These are those deemed not interesting and not necessary to audit, such as CAP\_SYS\_ADMIN checks on memory allocation to affect the behavior of overcommit.

[-K](#K)

Include kernel stack traces to the output.

[-U](#U)

Include user-space stack traces to the output.

[-x](#x)

Show extra fields in TID and INSETID columns.

[--cgroupmap MAPPATH](#cgroupmap)

Trace cgroups in this BPF map only (filtered in-kernel).

[--mntnsmap MAPPATH](#mntnsmap)

Trace mount namespaces in this BPF map only (filtered in-kernel).

[--unique](#unique)

Don't repeat stacks for the same PID or cgroup.

# [EXAMPLES](#EXAMPLES)

[Trace all capability checks system-wide:](#Trace)

\# **capable**

[Trace capability checks for PID 181:](#Trace~2)

\# **capable -p 181**

[Trace capability checks in a set of cgroups only (see special\_filtering.md](#Trace~3)

from bcc sources for more details): # **capable --cgroupmap /sys/fs/bpf/test01**

# [FIELDS](#FIELDS)

[TIME(s)](#TIME%28s%29)

Time of capability check: HH:MM:SS.

[UID](#UID)

User ID.

[PID](#PID)

Process ID.

[COMM](#COMM)

Process name. CAP Capability number. NAME Capability name. See [capabilities(7)](/man/enterprise-packages/bcc/capabilities.7) for descriptions.

[AUDIT](#AUDIT)

Whether this was an audit event. Use -v to include non-audit events. INSETID Whether the INSETID bit was set (Linux >= 5.1).

# [OVERHEAD](#OVERHEAD)

This adds low-overhead instrumentation to capability checks, which are expected to be low frequency, however, that depends on the application. Test in a lab environment before use.

# [SOURCE](#SOURCE)

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg

# [SEE ALSO](#SEE_ALSO)

[capabilities(7)](/man/enterprise-packages/bcc/capabilities.7)

2020-03-08 USER COMMANDS

---

Document: capable(8) from bcc 0.37.0-r3 (Chainguard OS)
Source: https://github.com/iovisor/bcc