• Bypass file read permission checks and directory read and execute permission checks;

• Invoke open_by_handle_at(2).

• Bypass permission checks on operations that normally require the filesystem UID of the process to match the UID of the file (e.g., chmod(2), utime(2)), excluding those operations covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH;

• set extended file attributes (see chattr(1)) on arbitrary files;

• set Access Control Lists (ACLs) on arbitrary files;

• ignore directory sticky bit on file deletion;

• specify O_NOATIME for arbitrary files in open(2) and fcntl(2).

• interface configuration;

• administration of IP firewall, masquerading, and accounting;

• modify routing tables;

• bind to any address for transparent proxying;

• set type-of-service (TOS)

• clear driver statistics;

• set promiscuous mode;

• enabling multicasting;

• use setsockopt(2) to set the following socket options: SO_DEBUG, SO_MARK, SO_PRIORITY (for a priority outside the range 0 to 6), SO_RCVBUFFORCE, and SO_SNDBUFFORCE.

• use RAW and PACKET sockets;

• bind to any address for transparent proxying.

• Perform a range of system administration operations including: quotactl(2), mount(2), umount(2), swapon(2), swapoff(2), sethostname(2), and setdomainname(2);

• perform privileged syslog(2) operations (since Linux 2.6.37, CAP_SYSLOG should be used to permit such operations);

• perform VM86_REQUEST_IRQ vm86(2) command;

• perform IPC_SET and IPC_RMID operations on arbitrary System V IPC objects;

• override RLIMIT_NPROC resource limit;

• perform operations on trusted and security Extended Attributes (see xattr(7));

• use lookup_dcookie(2);

• use ioprio_set(2) to assign IOPRIO_CLASS_RT and (before Linux 2.6.25) IOPRIO_CLASS_IDLE I/O scheduling classes;

• forge PID when passing socket credentials via UNIX domain sockets;

• exceed /proc/sys/fs/file-max, the system-wide limit on the number of open files, in system calls that open files (e.g., accept(2), execve(2), open(2), pipe(2));

• employ CLONE_* flags that create new namespaces with clone(2) and unshare(2) (but, since Linux 3.8, creating user namespaces does not require any capability);

• call perf_event_open(2);

• access privileged perf event information;

• call setns(2) (requires CAP_SYS_ADMIN in the target namespace);

• call fanotify_init(2);

• call bpf(2);

• perform KEYCTL_CHOWN and KEYCTL_SETPERM keyctl(2) operations;

• perform madvise(2) MADV_HWPOISON operation;

• employ the TIOCSTI ioctl(2) to insert characters into the input queue of a terminal other than the caller's controlling terminal;

• employ the obsolete nfsservctl(2) system call;

• employ the obsolete bdflush(2) system call;

• perform various privileged block-device ioctl(2) operations;

• perform various privileged filesystem ioctl(2) operations;

• perform administrative operations on many device drivers.

• Raise process nice value (nice(2), setpriority(2)) and change the nice value for arbitrary processes;

• set real-time scheduling policies for calling process, and set scheduling policies and priorities for arbitrary processes (sched_setscheduler(2), sched_setparam(2), shed_setattr(2));

• set CPU affinity for arbitrary processes (sched_setaffinity(2));

• set I/O scheduling class and priority for arbitrary processes (ioprio_set(2));

• apply migrate_pages(2) to arbitrary processes and allow processes to be migrated to arbitrary nodes;

• apply move_pages(2) to arbitrary processes;

• use the MPOL_MF_MOVE_ALL flag with mbind(2) and move_pages(2).

• Trace arbitrary processes using ptrace(2);

• apply get_robust_list(2) to arbitrary processes;

• transfer data to or from the memory of arbitrary processes using process_vm_readv(2) and process_vm_writev(2).

• inspect processes using kcmp(2).

• Perform I/O port operations (iopl(2) and ioperm(2));

• access /proc/kcore;

• employ the FIBMAP ioctl(2) operation;

• open devices for accessing x86 model-specific registers (MSRs, see msr(4))

• update /proc/sys/vm/mmap_min_addr;

• create memory mappings at addresses below the value specified by /proc/sys/vm/mmap_min_addr;

• map files in /proc/bus/pci;

• open /dev/mem and /dev/kmem;

• perform various SCSI device commands;

• perform certain operations on hpsa(4) and cciss(4) devices;

• perform a range of device-specific operations on other devices.

• Use reserved space on ext2 filesystems;

• make ioctl(2) calls controlling ext3 journaling;

• override disk quota limits;

• increase resource limits (see setrlimit(2));

• override RLIMIT_NPROC resource limit;

• override maximum number of consoles on console allocation;

• override maximum number of keymaps;

• allow more than 64hz interrupts from the real-time clock;

• raise msg_qbytes limit for a System V message queue above the limit in /proc/sys/kernel/msgmnb (see msgop(2) and msgctl(2));

• override the /proc/sys/fs/pipe-size-max limit when setting the capacity of a pipe using the F_SETPIPE_SZ fcntl(2) command.

• use F_SETPIPE_SZ to increase the capacity of a pipe above the limit specified by /proc/sys/fs/pipe-max-size;

• override /proc/sys/fs/mqueue/queues_max limit when creating POSIX message queues (see mq_overview(7));

• employ prctl(2) PR_SET_MM operation;

• set /proc/PID/oom_score_adj to a value lower than the value last set by a process with CAP_SYS_RESOURCE.

• Perform privileged syslog(2) operations. See syslog(2) for information on which operations require privilege.

• View kernel addresses exposed via /proc and other interfaces when /proc/sys/kernel/kptr_restrict has the value 1. (See the discussion of the kptr_restrict in proc(5).)