CAP_AUDIT_READ is not supported on Xenial

[Tom Carroll]

I'm encountering the same issue as #1451601 describes. The fix, a more recent libcap2 2.25, has made it into the Yakkety distribution but not Xenial.

Summary of the problem: One cannot raise or lower CAP_AUDIT_READ, which is equal to decimal value 37. As compiled, libcap2 2.24 supports up to CAP_BLOCK_SUSPEND (36).

lsb_release -rd
Description: Ubuntu 16.04.2 LTS
Release: 16.04

apt-cache policy libcap2
libcap2:
  Installed: 1:2.24-12
  Candidate: 1:2.24-12
  Version table:
 *** 1:2.24-12 500
        500 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 Packages
        100 /var/lib/dpkg/status

setcap cap_audit_read=eip /bin/ls
fatal error: Invalid argument
usage: setcap [-q] [-v] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) <filenameN> ]

 Note <filename> must be a regular (non-symlink) file.

[Serge Hallyn (serge-hallyn)]

Sorry - if this is still an issue, please reply here.

[Andrew G. Morgan (morganlibcap)]

This was fixed upstream in libcap-2.25 :

https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=9c3d89fbb9d819ade80b544f8a35f7b90c07cd14

[William Wilson (jawn-smith)]

Marking this as won't fix because xenial is no longer supported. All supported releases have libcap2 2.25 or newer, which fixes this bug.