{"record":{"id":"bec4abf8e366d86b","repo":"fluent/fluentd","slug":"capability-is-not-valid-capability-valid-cap","errorCode":null,"errorMessage":"'#{capability}' is not valid capability. Valid Capabilities are:  #{valid_capabilities.join(\", \")}","messagePattern":"'#(.+?)' is not valid capability\\. Valid Capabilities are:  #(.+?)","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/fluent/command/cap_ctl.rb","lineNumber":157,"sourceCode":"        puts \"Effective:   #{print.caps_text(:buffer, :effective)}\"\n        puts \"Inheritable: #{print.caps_text(:buffer, :inheritable)}\"\n        puts \"Permitted:   #{print.caps_text(:buffer, :permitted)}\"\n      end\n    end\n\n    def get_valid_capabilities\n      capabilities = []\n      cap = CapNG::Capability.new\n      cap.each do |_code, capability|\n        capabilities << capability\n      end\n      capabilities\n    end\n\n    def check_capabilities(capabilities, valid_capabilities)\n      capabilities.each do |capability|\n        unless valid_capabilities.include?(capability)\n          raise ArgumentError, \"'#{capability}' is not valid capability. Valid Capabilities are:  #{valid_capabilities.join(\", \")}\"\n        end\n      end\n    end\n\n    def parse_options!(argv)\n      begin\n        rest = @op.parse(argv)\n\n        if rest.length != 0\n          usage nil\n        end\n      rescue\n        usage $!.to_s\n      end\n    end\n  end\nend\n","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/command/cap_ctl.rb#L139-L175","documentation":"Raised as ArgumentError by fluent-cap-ctl (Linux only, requires the capng_c gem). Names given to --add or --drop are split on commas and each must appear in the list enumerated from libcap-ng via CapNG::Capability#each; the error text prints the full list of valid names. Names are exact, lowercase, with the cap_ prefix (cap_chown, cap_net_bind_service, cap_sys_admin, ...).","triggerScenarios":"fluent-cap-ctl --add net_bind_service (missing cap_ prefix); --add CAP_NET_BIND_SERVICE (wrong case); a capability name that does not exist in the libcap-ng version bundled with capng_c; stray spaces or empty items after comma-splitting.","commonSituations":"Granting fluentd's Ruby binary the ability to bind ports below 1024 with cap_net_bind_service; scripts copying names from setcap/capsh docs that use different casing; older capng_c builds lacking newer capabilities.","solutions":["Use the exact names from the error message's own 'Valid Capabilities are:' list, e.g. cap_net_bind_service","Run fluent-cap-ctl --get first to confirm the target, and copy-paste names from the printed list","Update the capng_c gem if your kernel has the capability but the gem does not","Alternatively use setcap on the binary instead of fluent-cap-ctl"],"exampleFix":"# before\nfluent-cap-ctl --add net_bind_service\n\n# after\nfluent-cap-ctl --add cap_net_bind_service","handlingStrategy":"validation","validationCode":"require 'capng'\nvalid = []\nCapNG::Capability.new.each { |_code, cap| valid << cap.to_s }\nrequested = ARGV[0].to_s.split(/\\s*,\\s*/)\nunknown = requested - valid\nabort \"unknown capabilities: #{unknown.join(', ')}\" unless unknown.empty?","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy capability names from the error message's own valid list","Use lowercase cap_-prefixed names from libcap-ng, not setcap-style CAP_X or bare names","Keep a reviewed list of capabilities in provisioning scripts instead of ad-hoc flags"],"tags":["fluentd","cli","capabilities","capng","linux"],"backgroundTag":"invalid-cli-argument","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}