iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Calling a process “root” tells you one thing: its user ID is 0. It does not tell you which capabilities the process holds, which user namespace its IDs map into, which system calls a seccomp filter allows, or which host files, devices and namespaces were handed to it. On Linux, the authority a process actually has is the combined result of all of those layers. This guide takes them one at a time, shows how to read them on a running process, and explains what the 2026 AI-agent privilege-escalation study can and cannot tell an administrator.
Why is Linux security more than root?
Traditional UNIX gave superuser almost everything in one bundle. If the kernel’s check was “is this process UID 0?”, a yes opened nearly every door. Linux splits that bundle into capabilities: discrete permissions that are controlled independently, and that are tracked per thread. A process can run as UID 0 with most of those permissions removed, and a non-zero UID can hold a narrow capability when a system is set up that way.
The five capability sets
The capabilities(7) man page defines five sets for each thread. They differ in when the kernel checks a permission and in what survives a call to execve(), which is how a process starts a new program.
| Set | What it does | What to look for |
|---|---|---|
| Permitted | The limiting superset. A thread can move capabilities from here into its Effective set. | A large Permitted set means the thread can raise its privilege if it chooses to. |
| Effective | The set the kernel checks when a privileged operation is attempted. | This is the set that decides what the process can do right now. |
| Inheritable | Capabilities that may be carried across execve(), where the new program’s file capability settings allow it. | A wide Inheritable set widens what a later-started program can request. |
| Bounding | A limit on the capabilities that can be acquired through execve(). | Removing a capability here stops programs started from this thread from regaining it that way. |
| Ambient | Capabilities kept across execve() by programs that have no file capabilities. | Matters for non-root programs that must keep a specific capability after they start. |
Reading the sets on a live process
The kernel exposes each set as a hexadecimal bitmask in /proc/PID/status. To read a process’s authority:
#1 Best Overall
- Check the user IDs and the no-new-privileges flag. Run
grep -E '^(Uid|NoNewPrivs)' /proc/PID/status. ANoNewPrivs: 1line means execve() cannot grant the process new privileges, for example through setuid binaries. - Read the capability masks. Run
grep '^Cap' /proc/PID/status. The lines are CapInh, CapPrm, CapEff, CapBnd and CapAmb, matching the five sets above. - Decode each mask. Pass a value to
capsh --decode=HEX, using the utility from the libcap tools, to see the capability names in that set. - Interpret the result. A UID-0 process whose CapEff and CapBnd are both reduced has far less authority than its UID suggests. A CapEff mask with every bit set up to the highest capability your kernel defines is effectively full root power for most purposes.
Which capabilities matter most?
The table below covers capabilities that come up most often in audits. It is a guide to scope rather than a complete list, and exact behaviour varies by kernel version, so confirm details against the capabilities(7) page for the kernel you run.
| Capability | What it covers | Why it matters |
|---|---|---|
| CAP_SYS_ADMIN | A large bundle of administrative operations, including filesystem mounting and many namespace operations. | Overloaded. Treat any holder as close to root. |
| CAP_BPF | BPF operations that were previously bundled under CAP_SYS_ADMIN. Added in Linux 5.8. | Lets BPF work be granted without the full administrative bundle, but some program types also need other capabilities. |
| CAP_NET_ADMIN | Network configuration: interfaces, routing and firewall rules. | Can reshape traffic and network visibility in the namespace it governs. |
| CAP_SYS_PTRACE | Tracing and inspecting other processes. | Can read or alter the state of processes it can reach. |
| CAP_DAC_OVERRIDE | Bypasses file read, write and execute permission checks. | Reaches files whose mode bits would otherwise deny access. |
What can root in a container actually do?
A container’s main process is usually UID 0 inside a user namespace, sometimes with a few capabilities retained. Whether that authority reaches the host depends on two things: how the namespace maps IDs, and what the container was given access to.
User namespaces scope IDs and capabilities
The user_namespaces(7) man page describes a user namespace as having its own mapping of user and group IDs and its own capability sets. A process that is UID 0 inside the namespace can hold capabilities over the resources that namespace governs. That authority does not automatically carry over to the initial namespace, where the host’s real IDs live.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The mapping is visible in /proc/PID/uid_map. Each line has three numbers: the first ID inside the namespace, the first ID outside it, and the length of the range. For example, a line reading 0 100000 65536 maps container UID 0 to host UID 100000, with 65536 IDs in the range. Inside, the process is root over namespace-owned resources. On the host, the same process is UID 100000, an unprivileged account.
Rank #2
Namespace scope does not cover what was handed in
Namespace isolation limits what a namespace-local root can change. It does not block resources the container was deliberately given. The configurations that most often widen that gap are:
- Bind-mounted host paths, especially writable ones.
- Host device nodes passed into the container.
- Shared host namespaces (PID, network or IPC) that put host-visible objects within reach.
- Added capabilities such as CAP_SYS_ADMIN.
- Access to a host runtime control socket, such as the Docker socket, which lets a client ask the host daemon to start new privileged containers.
| Setup | Namespace-local root? | Host-facing exposure | Practical reading |
|---|---|---|---|
| UID 0 in a user namespace, capabilities removed, no host mounts or devices | Yes, over resources that namespace governs | Limited to what the container still holds and can reach | Authority stays namespace-local; check the steps in the audit section. |
| Same process with a writable host bind mount | Yes | Direct: changes made through the mount land on the host filesystem | Host access is set by the mount, not by the UID. |
| Container granted CAP_SYS_ADMIN | Yes, across a broader set of operations | Depends on the mounts, devices and namespaces present | An overloaded capability; the namespace boundary matters less than what else is reachable. |
| Access to the host’s container runtime socket | Not the deciding factor | Host-level control through the host daemon | Authority comes from the socket, not from the container’s UID. |
Syscall filtering with seccomp
Seccomp lets a process install a filter, written as a BPF program, that inspects each system call and decides what happens to it: allow it, return an error, or terminate the process. The Linux kernel’s “Kernel Self-Protection” documentation describes the feature this way:
“The ‘seccomp’ system provides an opt-in feature made available to userspace, which provides a way to reduce the number of kernel entry points available to a running process.”
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
That is a statement about reducing the kernel code a process can reach. Seccomp removes entry points; it does not repair defects in the entry points it leaves open.
Checking whether a filter is active
Run grep -E '^(Seccomp|NoNewPrivs)' /proc/PID/status. A Seccomp value of 0 means no filtering, 1 means strict mode, and 2 means a filter program is installed. A filtered process that is not expected to be filtered is worth investigating.
Compatibility and failure modes
- An unprivileged process can install a filter only after setting NoNewPrivs, unless it holds CAP_SYS_ADMIN.
- A filter that returns an error makes the call fail, usually with EPERM. Applications may log the failure or retry instead of crashing, which can hide the cause.
- A filter that terminates the process shows up as a SIGSYS termination, with no error returned to the application.
eBPF: powerful, and gated by capabilities
eBPF runs verified programs inside the kernel and attaches them to subsystems, including networking, tracing and Linux Security Module hooks. That reach is why it is treated as privileged. Loading and attaching are subject to capability checks, and every program must pass the kernel verifier before it runs.
Who may load and attach
The eBPF syscall documentation ties load and attach operations to capability checks, and the required capability depends on the program type and the operation. CAP_BPF covers the BPF operations split out of CAP_SYS_ADMIN, but some program types need further capabilities. Do not assume CAP_BPF is sufficient without checking the requirements for the specific program type you run.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesOn many systems, the kernel.unprivileged_bpf_disabled sysctl controls whether unprivileged users can use BPF at all. Check it with sysctl kernel.unprivileged_bpf_disabled. Its accepted values and default vary with kernel version and distribution configuration.
BPF tokens delegate within a boundary
A BPF token allows a privileged party to delegate selected BPF operations to another process in a namespace-scoped way. The delegation is deliberate: whoever mounts the BPF filesystem sets delegation options that name the commands, program types, map types and attach types that may be used. What the token permits is limited to what that mount allowed.
When reviewing BPF exposure, check:
- Which processes hold CAP_BPF or CAP_SYS_ADMIN, and whether containers receive either one.
- Whether any BPF filesystem is mounted with delegation options, and what those options name.
- Which program types your monitoring, networking or security tooling actually loads.
Configuration weakness is not a kernel vulnerability
The Linux kernel threat model draws a line between configuration and boundary-crossing flaws. Configuration choices that explicitly increase exposure are treated as configuration matters. Actions by users who already hold the privilege needed for an action are excluded when they do not cross a further boundary. In practice, three situations need different responses:
- Configuration: an administrator grants a capability, mounts a host path or removes a filter. The fix is a configuration change.
- Privilege already held: a user who already has the required privilege performs an action with no further boundary crossed. This is not a kernel bypass.
- Kernel vulnerability: an action crosses a boundary the kernel is designed to enforce. This is the category that calls for a patch and a vulnerability report.
Can AI agents find Linux privilege-escalation paths?
Yes, under controlled benchmark conditions, and the results depend heavily on the setup. The 2026 PrivEscalate preprint is the most specific public measurement of this so far, and its limits matter as much as its findings.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat PrivEscalate measured
The paper, “PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation” by Yixuan Liu, Zilong Zhen, Yin Wu and Yi Li (arXiv:2609.09087v1, submitted 8 September 2026), builds a benchmark of 531 Dockerized scenarios across 14 subcategories, plus 329 parameterized variants. It evaluates six LLMs across three agent architectures. The authors report that capability differs by vulnerability class, that results shift when the environment changes, and that the agent architecture has a material effect.
What the reported figures mean
For the individual models the paper reports, per-model success retention under environmental perturbation ranged from 59.0% to 78.2%. The authors also report gains from a domain-specialized agent wrapper. Those gains and the exact figures sit in the paper’s experiments, and should be read alongside its setup rather than as headline numbers.
These are measurements from one benchmark, with specific models, scenarios and agent designs. They do not estimate how often attackers compromise deployed Linux systems, and they do not show that all LLMs behave alike.
Scope: local escalation after a foothold
The paper’s threat model covers local privilege escalation after an attacker already has initial access, and it excludes exploitation of kernel CVEs. It therefore says nothing direct about kernel vulnerability exploitation or about how attackers obtain initial access. The term “privilege escalation” in the paper refers to moving from an unprivileged local foothold toward higher privilege inside Dockerized scenarios.
Publication status
The arXiv record shows the paper as version 1 and lists CCS ’26 as its venue, with proceedings scheduled for 15–19 November 2026. As of 9 October 2026 that conference has not taken place, so the paper should be cited as a preprint. The authors describe the benchmark as supporting LLM-agent evaluation, defensive tool validation and red-team training.
Auditing privilege on a host or container
Run these checks against a suspect process, then compare the results with a known-good baseline:
Quick Recap
- Map the process’s IDs. Run
cat /proc/PID/uid_mapandreadlink /proc/PID/ns/user. Compare the namespace link withreadlink /proc/1/ns/useron the host. A matching link means the process shares the host’s user namespace; a different one means it runs in a namespace whose UID 0 may map to an unprivileged host ID. - Read and decode the capability masks. Run
grep '^Cap' /proc/PID/status, then decode each value withcapsh --decode=HEX. In a hardened container, CapEff and CapBnd should show far fewer capabilities than a full set. - Confirm seccomp and NoNewPrivs. Run
grep -E '^(Seccomp|NoNewPrivs)' /proc/PID/status. A filtered workload should showSeccomp: 2. - Review mounts, devices and shared namespaces. Run
findmntand list the device nodes the process can see. Check for writable host bind mounts, and compare namespace membership withlsns -p PID. - Check BPF exposure. Run
sysctl kernel.unprivileged_bpf_disabledandfindmnt -t bpf. Review any BPF filesystem mount for delegation options. - Retest the workload after each tightening step. Use the branches below when something breaks.
When a workload breaks after tightening
- A system call returns EPERM. Run the program under
strace -f -o /tmp/trace.txt COMMANDand search the output for EPERM. Determine whether a missing capability, such as CAP_NET_ADMIN or CAP_SYS_ADMIN, or a seccomp rule is responsible. Restore only the permission the workload genuinely needs. - The process terminates with SIGSYS. A seccomp filter in a terminating action blocked a system call. Identify the call from the trace and add it to the allow list only if the workload legitimately needs it.
- A non-root program loses a capability across execve(). Check the Ambient and Inheritable sets in its launch chain. Ambient capabilities are the mechanism that keeps a capability across execve() for programs without file capabilities.
- An eBPF load fails with EPERM. Confirm the capability required by that program type, check
kernel.unprivileged_bpf_disabled, and confirm the loader is not running in a user namespace where the capability has no effect on the resource it needs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
