Linux Edu Handbook

capceiling with no arguments will display the current capabilities ceiling

capceiling (-|=)[ ]capability [capability...] <program>

run program with a reduced capability ceiling

The new ceiling is just a space delimited list of capabilities preceeded by either a '-' or '='
'=': The new capabilities ceiling will be exactly the capabilities specified on the command line minus any capabilities removed earlier.
'-': The capabilities listed on the command line will be subtracted from the existing capabilities.
'+': This is an error. Capabilities cannot be added to the ceiling.

<program> should be what is run with the modified capability ceiling (e.g. /bin/bash or /etc/init.d/apache).

The space between - or = and the first capability is optional.