CAP_NET_BIND_SERVICE
if (snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
if (vci > 0 && vci < ATM_NOT_RSV_VCI && !capable(CAP_NET_BIND_SERVICE))
if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
!ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
!ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
if (!capable(CAP_NET_BIND_SERVICE))
if (!capable(CAP_NET_BIND_SERVICE)) {
if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
!ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
!ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
!capable(CAP_NET_BIND_SERVICE)) {
if (port <= LAST_RESERVED_PORT && !capable(CAP_NET_BIND_SERVICE))
const __u64 net_bind_svc_cap = 1ULL << CAP_NET_BIND_SERVICE;
capng_update(CAPNG_DROP, CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE);
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0, 0) != -1 || errno != EPERM) {
capng_update(CAPNG_ADD, CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE);
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0) {
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_NET_BIND_SERVICE, 0, 0, 0) != 1) {
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0) {
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0)
capng_update(CAPNG_DROP, CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE);
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0) {
capng_update(CAPNG_ADD, CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE);
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0)
if (capng_have_capability(CAPNG_EFFECTIVE, CAP_NET_BIND_SERVICE) != bool_arg(argv, 1)) {
if (capng_have_capability(CAPNG_PERMITTED, CAP_NET_BIND_SERVICE) != bool_arg(argv, 2)) {
if (capng_have_capability(CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE) != bool_arg(argv, 3)) {
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_NET_BIND_SERVICE, 0, 0, 0) != bool_arg(argv, 4)) {
CAP_NET_BIND_SERVICE,
set_cap(_metadata, CAP_NET_BIND_SERVICE);
clear_cap(_metadata, CAP_NET_BIND_SERVICE);