Mdtryhht

root@macine:~# getcap ./some_bin
./some_bin =ep

What does "ep" mean? What are the capabilities of this binary?

# getcap ./some_bin
./some_bin =ep

That file has ALL the capabilites set in the effective(e) and permitted(p) set.

In the textual representation of capabilities, a leading = is equivalent to all=.
From the cap_to_text(3) manpage:

In the case that the leading operator is =, and no list of capabilities is provided, the action-list is assumed to refer to all capabilities. For example, the following three clauses are equivalent to each
other (and indicate a completely empty capability set): all=; =;
cap_chown,<every-other-capability>=.

Such a binary can do whatever it pleases, limited only by the capability bounding set, which on a desktop system includes everything (otherwise setuid binaries like su wouldn't work as expected).

Notice that this is only a "gotcha" of the textual representation used by libpcap: in the security.capability extended attribute of the file for which getcap will print /file/path =ep, all the meaningful bits are effectively on; for an empty security.capability, /file/path = (with the = not followed by anything) will be returned instead.

If someone is still not convinced about all that, here is a small experiment:

# cp /bin/ping /tmp/ping # will wipe setuid bits and extented attributes
# su user -c '/tmp/ping localhost'
ping: socket: Operation not permitted
# setcap =ep /tmp/ping
# su user -c '/tmp/ping localhost' # will work because of cap_net_raw
PING localhost(localhost (::1)) 56 data bytes
64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.073 ms
^C
# setcap = /tmp/ping
# su user -c '/tmp/ping localhost'
ping: socket: Operation not permitted

The capabilities are put in the permitted set (p), and all permitted capabilities are copied into the effective set (e). There does not seem to be any capabilities in your example (where did you get it from?).

The e is used for legacy programs (possibly most programs at the current time), that is programs that don't know about capabilities, so can not them-selves copy capabilities from permitted to effective.