File capabilities are a Linux feature that lets a program receive specific privileges, such as binding to low ports or managing network settings, without running as full root. The privileges are stored as metadata on the executable and are applied when the file is launched.
They matter because they support least privilege: software can do only the sensitive actions it truly needs. In cyber security, this reduces the damage from a compromise, but it also creates a boundary that attackers may target. If an application, launcher, or update process misconfigures file capabilities, a low-privileged user may gain unintended access or a helper may run with more power than expected. Defenders should audit capability assignments, restrict which binaries carry them, and verify that sandbox and launch helpers preserve them correctly.