Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTo let a non-root Linux service listen on port 80, 443, or another port below 1024, grant its actual executable the CAP_NET_BIND_SERVICE capability: sudo setcap 'cap_net_bind_service=+ep' /absolute/path/to/program. Verify it with getcap, restart the service, and confirm that the service—not merely the command—opens the port. File capabilities can disappear when an executable is replaced or copied without its extended attributes, so a service-manager configuration may be a better fit for some deployments.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What CAP_NET_BIND_SERVICE does
Linux treats port numbers below 1024 as privileged for Internet-domain sockets. The CAP_NET_BIND_SERVICE capability allows a process to bind those ports without running with user ID 0. A web server running as an ordinary account can therefore open port 80 or 443 while retaining the smaller privilege set of that account.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThis is a capability, not a general conversion of the account into root. It authorizes the specific low-port operation. Other privileged operations still require their own permissions. Granting only this capability is preferable to starting an entire worker process as UID 0 when the application needs no other root-level access.
Before changing anything
Find the executable the service really runs
Apply the capability to the executable that the service manager ultimately executes. Do not assume that the name in a shell command is the binary that opens the socket. A service may start through a wrapper, launch an interpreter, or use a symlink whose target is elsewhere.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Use the absolute path to the dedicated executable whenever possible.
- Check the service definition and its start command rather than relying on a shell alias or interactive command.
- For a symlink, determine which target is actually executed and consider whether an upgrade will replace that target.
- If the process runs in a container, check the container’s executable and capability policy as well as the host file.
The command succeeds only for the file you name. A successful command does not prove that the service launched that same file.
Decide whether file metadata fits your deployment
setcap stores the capability in the executable’s security.capability extended attribute. This is convenient for one dedicated binary, but the attribute is part of the file’s lifecycle. Replacing the file, installing a new package version, or copying it without extended attributes can remove the permission. If the service is frequently redeployed, a systemd unit setting can make the privilege visible in configuration instead.
Grant the capability with setcap
1. Assign only CAP_NET_BIND_SERVICE
Run the command as an administrator, substituting the executable’s real absolute path:
sudo setcap 'cap_net_bind_service=+ep' /absolute/path/to/programThe capability name is CAP_NET_BIND_SERVICE. In the capability string, +e places it in the effective set and +p places it in the permitted set when the file is executed. Together, +ep gives the launched program the capability it needs for the bind operation.
Quote the capability expression as shown so the shell passes it to setcap unchanged. Keep the path tied to the version of the executable that the service actually starts.
2. Inspect the file capability
Use the companion inspection command:
getcap /absolute/path/to/programFor a correctly assigned capability, the output contains:
Recommended Free Tools
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
/absolute/path/to/program cap_net_bind_service=epThe important part is cap_net_bind_service=ep. If there is no output, the file has no capability set (or the path is not the file you changed). The setcap utility also supports verification with -v when you need to validate a file capability explicitly.
3. Restart the service
Restart the service through the same service manager and account used in production. A process that was already running does not retroactively receive a file capability; it must execute the file after the attribute is present.
After the restart, check the service’s own logs and inspect the socket using the normal tools for your system. Confirm that the intended process opened the intended low port. Do not treat a successful setcap invocation, by itself, as evidence that the service launched the modified executable.
Remove the permission when it is no longer needed
Revoke the file capability with:
sudo setcap -r /absolute/path/to/programThe special -r form removes the capability set from the file. Restart the service after revocation if you need the running process to be replaced; removing metadata from disk does not alter privileges already held by a process that is still running.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use systemd instead of changing the executable
For a service managed by systemd, you can keep the executable unchanged and grant the capability from the unit’s [Service] section:
[Service]
User=app
AmbientCapabilities=CAP_NET_BIND_SERVICEAmbientCapabilities is designed for executing a process as a non-privileged user while granting selected capabilities. The setting makes the requirement visible alongside the service’s user and startup policy, rather than hiding it in an extended attribute on a binary.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
After editing a unit or drop-in, reload the manager’s unit configuration using your normal systemd workflow, restart the service, and verify the resulting socket. Keep the capability list narrow; adding unrelated capabilities defeats the purpose of this configuration.
Check NoNewPrivileges when it fails
systemd’s NoNewPrivileges=true prevents a process from gaining privileges through execve(), including privileges supplied by filesystem capabilities. If that policy is enabled in the unit or inherited from manager policy, a file capability may be present on disk yet unusable at launch. Review the effective unit settings and the service’s capability restrictions before changing the executable.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →File capability versus systemd capability
| Consideration | File capability with setcap |
systemd AmbientCapabilities |
|---|---|---|
| Scope | Attached to one executable file. | Applied to a process started by one service unit. |
| Where the requirement is visible | In the executable’s security.capability extended attribute. |
In the unit’s [Service] configuration. |
| Effect of replacing the executable | The replacement may lose the attribute and require reapplication. | The unit setting remains separate from the binary. |
| Wrappers and interpreters | Must be attached to the executable that is actually executed; assigning it to a script does not automatically grant it to the interpreter. | Can grant the capability to the service process regardless of which configured executable it starts, subject to systemd policy. |
| Policy restrictions | Can be blocked when a service or manager uses NoNewPrivileges, or when a capability bounding set removes the capability. |
Still depends on systemd’s capability and bounding-set policy. |
| Privilege model | Both approaches allow the worker to run without UID 0 while granting the low-port capability. | Both approaches allow the worker to run without UID 0 while granting the low-port capability. |
Choose the file form when a single stable executable is the natural ownership boundary and its deployment preserves extended attributes. Choose the unit form when the service definition is the authoritative deployment artifact, when wrappers make the executed file ambiguous, or when you want the privilege requirement audited in service configuration.
Troubleshoot Operation not permitted
Confirm the path and process
First verify the exact file named in the service’s start command. Then run getcap against that path. A common failure is assigning the capability to a helper, symlink, or old release while the service executes a different binary.
getcap /absolute/path/to/programIf the expected cap_net_bind_service=ep is missing, reapply it to the executable that will be launched and restart the service.
Check for wrappers and interpreters
A file capability on a shell or other script does not automatically transfer to the interpreter that reads it. Granting the capability to a shared interpreter can affect every script that uses that interpreter, creating a much wider privilege boundary than intended. Prefer a dedicated compiled executable, or grant the capability through the service manager.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Check systemd restrictions
Inspect the effective unit configuration for NoNewPrivileges=true and for capability bounding-set restrictions. The capability has to survive the complete execution path: the service manager must permit it, the launched process must retain it, and no container or sandbox policy may remove it before the bind call.
Check container boundaries
When the service runs in a container, a host-side file capability does not guarantee that the containerized process can use it. The image may contain a different executable, and the runtime may impose a capability bounding set that excludes CAP_NET_BIND_SERVICE. Diagnose the process and policy inside the container as well as the host file.
Check the port itself
Even with the capability, the service cannot bind a port already occupied by another process. Confirm that the configured address and port are the ones you intend to open and that the previous instance has stopped. A capability error and an address-in-use error require different fixes; use the service log to distinguish them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the capability disappears after an upgrade
File capabilities are extended attributes, not ordinary text in the program’s configuration. A package upgrade that replaces the executable creates a new file that may not carry the old security.capability attribute. Copying a binary through a mechanism that does not preserve extended attributes has the same result.
After every deployment that replaces the executable, verify it explicitly:
getcap /absolute/path/to/programIf the output no longer contains cap_net_bind_service=ep, reapply the capability as part of the deployment and restart the service. An alternative is to move the permission into the systemd unit so that the service configuration, rather than the binary’s metadata, declares the requirement.
Make the check part of release operations
- Identify the release path that the service will execute.
- Run
getcapafter installation or replacement. - Reapply
setcaponly to the intended executable when the attribute is absent. - Restart the service and validate the socket from the service’s logs or socket inspection.
- Record which service owns the capability so it can be removed when the low-port requirement ends.
Security boundaries and least privilege
Grant one capability, not a broad set
The useful permission for ports below 1024 is CAP_NET_BIND_SERVICE. Avoid adding unrelated capabilities to the same file or service. A smaller capability set limits what a compromised worker can do and makes the reason for the exception easier to audit.
Prefer a dedicated executable
Attaching the capability to a binary used only by the intended service keeps the scope narrow. A shared interpreter, general-purpose launcher, or widely reused helper expands the number of programs that could inherit the ability to bind privileged ports.
Review the whole launch chain
Capabilities are effective only if they survive from the service manager through every execution step. Wrappers, interpreters, containers, NoNewPrivileges, and capability bounding sets can change the final process’s privilege state. Troubleshoot the process that makes the bind call, not just the file on which you first ran setcap.
Remove stale permissions
When the service moves to a high port, gains a front-end proxy, or is retired, remove the file capability with sudo setcap -r or delete the corresponding systemd setting. Leaving an unnecessary low-port permission attached to a long-lived executable creates avoidable exposure.
Practical decision checklist
- Need one stable binary to open port 80 or 443: apply
setcap 'cap_net_bind_service=+ep'to that binary and verify it withgetcap. - Service starts through wrappers, changes binaries often, or is deployed from unit files: consider
AmbientCapabilities=CAP_NET_BIND_SERVICEin the systemd service. - The command worked but the service still cannot bind: verify the executed path, restart the process, and inspect systemd, container, and bounding-set restrictions.
- The permission vanished after an upgrade: check the new file’s
security.capabilityattribute and reapply it or move the setting into systemd. - The capability is no longer needed: remove it from the file or unit and restart the service.
What a successful setup looks like
The final state has four parts: the service runs under its intended non-root account; the exact executable that performs the bind has cap_net_bind_service=ep or the unit grants CAP_NET_BIND_SERVICE; no policy removes that capability during execution; and service logs or socket inspection confirm that the intended process owns the low port. Keeping those checks together prevents the common mistake of treating metadata on one file as proof about the process that is actually serving traffic.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
