1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
.TH PSCAP: "8" "Feb 2026" "Red Hat" "System Administration Utilities"
.SH NAME
pscap \- a program to see capabilities
.SH SYNOPSIS
.B pscap [ \-a | \-p pid | \-\-tree ]
.SH DESCRIPTION
\fBpscap\fP is a program that prints out a report of process capabilities. If the application has any capabilities, it will be in the report. By giving a pid with the \-p command line option, only the process specified with the pid is reported. If a process is not in the report, it has dropped all capabilities. If the process has partial capabilities, it is further examined to see if it has an open-ended bounding set. If this is found to be true, a '+' symbol is added. If the process has ambient capabilities, a '@' symbols is added.
The command name in the output may be followed by an asterisk mark (*). This mark denotes processes which run in child user namespaces (relative to the user namespace of pscap itself).
The \fB\-\-tree\fP option causes the output of the program to be mapped into a tree structure so that the relationships between processes can be studied to see what capabilities might be leaked to child processes.
.SH "SEE ALSO"
.BR netcap (8),
.BR filecap (8),
.BR capabilities (7),
.BR ps (8).
.SH AUTHOR
Steve Grubb
|
