39.5. Transformation of Process Capabilities During exec()

During an exec(), the kernel sets new capabilities for the process based on the process’s current capabilities and the capability sets of the file being executed. The kernel calculates the new capabilities of the process using the following rules:

P'(permitted) = (P(inheritable) & F(inheritable)) | (F(permitted) & cap_bset)

P'(effective) = F(effective) ? P'(permitted) : 0

P'(inheritable) = P(inheritable)