Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Give a specific executable the CAP_NET_BIND_SERVICE capability and it can bind TCP or UDP ports below 1024 without running as UID 0. The usual command is:
sudo setcap 'cap_net_bind_service=+ep' /absolute/path/to/programVerify the attribute with getcap, restart the service, and confirm from that service’s logs or socket state that the process opened the intended port. This grants one narrowly defined kernel capability; it does not make the program root and does not automatically follow wrappers, interpreters, containers, or replacement binaries.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What CAP_NET_BIND_SERVICE does
Linux treats port numbers below 1024 as privileged for this purpose. The kernel capability named CAP_NET_BIND_SERVICE permits a process to bind an Internet-domain socket to one of those ports. A web server that needs port 80 or 443 can therefore remain under an ordinary service account instead of starting with UID 0.
A capability is narrower than full root access. The setting discussed here authorizes low-port binding only; it does not grant arbitrary file access, unrestricted administration, or every operation traditionally associated with root. Keep the grant as narrow as the application allows.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
setcap stores a file capability on an executable. The metadata is held in the file’s security.capability extended attribute, and the kernel applies it when that executable is run. Because the permission belongs to the file and not to a package name or service account, the exact file that the service executes matters.
Before changing anything
Confirm the real executable
Find the absolute path of the program that actually opens the socket. A service may start through a launcher, shell script, symlink, supervisor, or another wrapper before reaching its worker binary. Applying a capability to an unused copy will produce a successful command but no change in the running service.
- Read the service definition or startup command and identify the final executable.
- Resolve symlinks and check which file is replaced during upgrades.
- Record the path so deployment automation can reapply the setting to that same file.
- For a script-based service, identify the dedicated compiled executable that performs the bind, if one exists.
You need administrative permission to write the extended attribute, which is why the examples use sudo. The service itself can continue to run as a non-root account after the capability is assigned.
Check whether the service manager or runtime imposes limits
Capabilities must survive the complete execution path. A systemd unit, container runtime, or capability bounding set can remove a capability even when the file shows the expected attribute. Note the user, executable, wrapper chain, and isolation settings before changing the file.
Assign the capability with setcap
- Apply the capability to the actual executable. Substitute the absolute path used by the service:
sudo setcap 'cap_net_bind_service=+ep' /absolute/path/to/programThe quoted capability expression names the operation and the capability sets to populate.
+eplaces it in the effective set, while+pplaces it in the permitted set when the file is executed. Together,+epmakes the low-port permission available to the launched process. - Inspect the result.
getcap /absolute/path/to/programFor a successful assignment, the output contains:
/absolute/path/to/program cap_net_bind_service=epThe path and formatting may vary slightly by distribution, but the important value is
cap_net_bind_service=ep.The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Rank #2
EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
- Restart the service. A process already running does not retroactively become the process described by a newly changed file. Restart it through the same service manager or launch procedure used in production.
- Confirm the outcome from the service itself. Check its logs for a successful bind and inspect the listening socket with your normal socket-inspection procedure. A successful
setcapcommand proves only that metadata was written; it does not prove that the service launched this file or reached the bind call.
Understanding the capability expression
The expression cap_net_bind_service=+ep has three parts. cap_net_bind_service is the kernel capability that covers privileged Internet-domain ports. The equals sign introduces the requested state. The letters e and p select the effective and permitted sets.
- Permitted (
p): the capability is available to the process as it starts. - Effective (
e): the capability is active for operations that require it.
Do not replace this narrow capability with a broad collection of capabilities copied from an unrelated service. The objective is to authorize the one kernel check needed for ports below 1024.
Remove the permission
When the service no longer needs a privileged port, remove the file capability:
sudo setcap -r /absolute/path/to/programThe special -r option removes the capability set from the file. Verify that removal with:
getcap /absolute/path/to/programAfter revocation, restart the service and make sure it either uses an unprivileged port or fails in the expected, controlled way. Removing the attribute from disk does not change an already running process; restart is required to test the new permission boundary.
Use systemd instead of changing the binary
If systemd launches the service, you can keep the executable unchanged and grant the capability in the unit’s [Service] section:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
[Service]
User=app
AmbientCapabilities=CAP_NET_BIND_SERVICEAmbientCapabilities=CAP_NET_BIND_SERVICE tells systemd to execute the process as a non-privileged user while carrying the selected capability into the process. This puts the decision in the unit configuration, where operators can review it alongside the service user and other sandbox settings.
When the systemd method is preferable
- Use it when the same executable is shared by several services but only one service needs a low port.
- Use it when deployment replaces binaries frequently and you want the permission managed with the unit rather than reattached to every file copy.
- Use it when wrappers or launchers make the final executable difficult to identify, provided systemd is the process that controls the complete launch.
Check NoNewPrivileges
A unit or manager policy with NoNewPrivileges=true prevents a process from gaining new privileges through execve(), including privileges supplied by filesystem capabilities. If a file-capability setup or another capability-based launch fails under systemd, inspect this setting and the unit’s effective policy. Removing or changing a hardening control should be a deliberate security decision, not an automatic troubleshooting step.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11File capabilities versus systemd ambient capabilities
| Decision point | File capability with setcap | systemd AmbientCapabilities |
|---|---|---|
| Scope | Attached to one executable file; any service that executes that file can receive the attribute. | Attached to one systemd service definition and its launched process. |
| Configuration visibility | Stored in the executable’s security.capability extended attribute; inspect with getcap. |
Visible in the unit’s [Service] configuration. |
| Binary replacement | Replacing or copying the file can remove the attribute and require reapplication. | The unit setting remains while the service definition remains unchanged. |
| Wrappers and interpreters | Works only when the capability is present on the executable that actually performs the bind and survives the execution chain. | Can carry the selected capability through the service launch, subject to systemd policy and the resulting process tree. |
| Runtime restrictions | Can still be blocked by a capability bounding set, container policy, or NoNewPrivileges. |
Can still be limited by systemd’s security settings, a bounding set, or container policy. |
| Root avoidance | Allows the worker to run under its configured non-root account. | Allows the process to run under the non-root User= account while receiving the selected capability. |
Both approaches avoid running the worker as UID 0. Choose the one whose lifecycle is easiest to audit: a file attribute for a dedicated, stable executable, or a unit declaration for a service-specific policy.
Scripts, interpreters, wrappers, and symlinks
Why scripts are a common failure point
Applying a file capability to a shell or language script does not automatically grant the interpreter the same capability. The kernel starts the interpreter, and that interpreter may not inherit the intended file privilege from the script. The result can be an apparently correct getcap output on the script while the application still reports Operation not permitted.
Granting the capability directly to a shared interpreter is risky: every script using that interpreter could gain the ability to bind low ports. Prefer the application’s dedicated compiled executable or a service-manager capability instead.
Follow the wrapper chain
A launcher may execute a different binary after reading configuration, changing directory, dropping privileges, or spawning a worker. Apply the setting to the binary that makes the socket call, then verify the service’s actual process and logs after restart. A symlink or an obsolete release path can also leave the modified file unused.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Why setcap appears to stop working after an upgrade
File capabilities live in the executable’s security.capability extended attribute. Package upgrades, atomic deployments, copying a file without its extended attributes, and replacing a release directory can therefore remove the permission even when the program name and service account have not changed.
Make the permission part of deployment
- Install or unpack the new executable.
- Apply
sudo setcap 'cap_net_bind_service=+ep' /absolute/path/to/programto that new file. - Run
getcap /absolute/path/to/programas a deployment check and fail the rollout if the expected value is absent. - Restart the service and verify the listening socket and service logs.
Do not assume that a capability attached to an old release follows a symlink to a new release. Treat each replacement executable as a new object whose attribute must be checked.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot “Operation not permitted”
Use this order so that you distinguish a missing file attribute from a launch-policy problem.
1. Verify the path
Confirm that the service executes the exact file you modified. Inspect the unit or startup command, resolve wrappers and symlinks, and check that the process is not launching a different release, helper, or interpreter.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems2. Verify the attribute
getcap /absolute/path/to/programThe output should include cap_net_bind_service=ep. If it is empty or names a different capability, reapply the command with the correct absolute path.
3. Restart and observe the real process
Restart through the production launch mechanism, then read the service’s own logs and inspect the listening socket. This catches cases where the command was tested manually with one binary while the service starts another.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
4. Inspect systemd restrictions
For a systemd service, review AmbientCapabilities, NoNewPrivileges, and any capability bounding policy. NoNewPrivileges=true blocks gaining privileges through execve(), which includes filesystem capabilities. A bounding set can remove the capability before the process reaches the bind call.
5. Inspect container policy
If the service runs in a container, the host file attribute alone may not be sufficient. The container runtime can remove capabilities or impose its own bounding set. Check the container’s effective policy and the executable inside the container, not only the host copy.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Check the port and competing processes
A low-port failure is not always a capability failure. Confirm that another process is not already listening on the requested address and port, and that the service is attempting the expected protocol and bind address. Use the service’s diagnostic output to separate an authorization error from an address-in-use or configuration error.
Security practices and operational boundaries
- Grant one capability: use only
CAP_NET_BIND_SERVICEunless the application has a separately documented requirement. - Use a dedicated executable: avoid placing the attribute on a shared interpreter or broadly reused administrative tool.
- Run as a service account: set the service user explicitly and keep filesystem ownership and access permissions independent of the low-port grant.
- Review changes: record which path received the attribute, why it needs a low port, and how deployment will reapply it.
- Verify after replacement: package and release upgrades can discard
security.capability, so makegetcappart of the post-install check. - Revoke when finished: use
setcap -rand restart the service when the capability is no longer required. - Respect hardening controls: do not weaken
NoNewPrivileges, container restrictions, or capability bounding sets without understanding the security effect.
Operational checklist
- Identify the final executable that binds the socket.
- Confirm the target port is below 1024 and that the service should remain non-root.
- Apply
sudo setcap 'cap_net_bind_service=+ep' /absolute/path/to/program. - Confirm
getcapreportscap_net_bind_service=epon that exact file. - Restart the service using its normal manager.
- Check service logs and socket state for a successful bind.
- If it fails, inspect wrappers, interpreters, systemd policy, container policy, and capability bounding sets.
- After every binary replacement, repeat the attribute check.
- When the low port is no longer needed, run
sudo setcap -r /absolute/path/to/programand restart.
Common questions answered by the setup
Does setcap make the program root?
No. It adds the selected capability to the executable’s launch credentials. The service can continue running under its ordinary non-root user, with permission limited to the capability granted.
Why does getcap show the right value but the service still fails?
The service may execute another file, start through an interpreter, or run under systemd or a container policy that removes the capability. Trace the complete execution path and inspect those restrictions.
Should I put the capability on a shell script?
No. A script’s interpreter does not automatically receive the script’s file capability, and granting it to a shared interpreter can affect unrelated scripts. Use the dedicated executable or a service-manager setting.
Which approach survives upgrades better?
A file capability must be reapplied whenever the executable is replaced or its extended attribute is lost. A systemd declaration remains in the unit, but the service still depends on its manager and capability policy. Choose the lifecycle that your deployment and audit process can verify.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
