Capabilities are fine-grained privileges like cap_net_bind_service that let a binary bind low ports without full root. The -r flag deletes every capability from the file, restoring normal execution. Audit what is set with getcap -r / 2>/dev/null.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.