When using setcap for a file, is this change permanent or do I have to invoke setcap somewhere at boot time?
setcap cap_sys_nice fooexecutable
The setcap on the file stores the capabilities in an extended attribute with a call to setxattr. This extended attribute is stored like other attributes (ownership, rights...) in the filesystem.
Since kernel 2.6.24, the kernel supports associating capability sets
with an executable file using setcap(8). The file capability sets are
stored in an extended attribute (see setxattr(2)) named
security.capability.
So, you don't have to reset your cap on each reboot.
