setcap

Set file capabilities

high risk

interactive breakdown — edit the command and press Explain
$ 
⚠ Risks & cautions
Safer / dry-run alternatives
systemctl edit <unit> # AmbientCapabilities=CAP_NET_BIND_SERVICEGrant capabilities via systemd instead
What it does

Assigns capabilities such as cap_net_bind_service to executables.

Common flags
FlagMeaning
-rRemove capabilities
Examples
setcap cap_net_bind_service=+ep /usr/bin/myappAllow binding to low ports · explain & risk-check →
setcap -r /usr/bin/myappRemove capabilities · explain & risk-check →
Related
getcap
Open the full explainer →More in System & Processes

Reference text is hand-written and may be incomplete — check man setcap for your version. Test destructive commands on a non-production system first.