问题
To add the cap_net_raw capability to (for eg /bin/ping), we use the following:
#setcap cap_net_raw=ep /bin/ping
What is the meaning of ep and why is it required here ?
回答1:
This sets the CAP_NET_RAW bit in both the "effective" (e) and "permitted" (p) capability sets. These two sets, along with the "inheritable" set, govern the capabilities that a process has or can set.
See more here:
capabilities - Linux man page
Capability Sets
Each thread has three capability sets containing zero or more of the above capabilities:
Effective- the capabilities used by the kernel to perform permission checks for the thread.
Permitted- the capabilities that the thread may assume (i.e., a limiting superset for the effective and inheritable sets). If a thread drops a capability from its permitted set, it can never re-acquire that capability (unless it exec()s a set-user-ID-root program).
inheritable- the capabilities preserved across an execve(2). A child created via fork(2) inherits copies of its parent's capability sets. See below for a discussion of the treatment of capabilities during exec(). Using capset(2), a thread may manipulate its own capability sets, or, if it has the CAP_SETPCAP capability, those of a thread in another process.
来源：https://stackoverflow.com/questions/7860690/using-setcap-in-linux