PR_CAPBSET_DROP(2const)

💅 PR_CAPBSET_DROP — the prctl(2) const page, bestie edition ✨

okay so quick vibe check: this is PR_CAPBSET_DROP(2const), one of the prctl(2) operations, and it lives in the Standard C library (libc, link it with -lc). it's giving "security lock down era" and honestly? iconic. 🎀

---

✨ NAME ✨

PR_CAPBSET_DROP — drop a capability from the calling thread's capability bounding set 🦋

like, you're literally telling the kernel "yeah no, take that one away from me and everyone who comes after me."

---

📚 LIBRARY 📚

Standard C library (libc, -lc) 💖

so like, normal libc stuff, no weird extra library to hunt down, periodt.

---

🌸 SYNOPSIS 🌸

#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>

int prctl(PR_CAPBSET_DROP, long cap);

see how cap is a long? yeah. it's a long. we don't make the rules, we just inherit them from the kernel. 🙈

---

👑 DESCRIPTION 👑

okay so the main character move here: you call prctl() with PR_CAPBSET_DROP, and you hand it cap — the capability you want gone. the kernel drops that capability specified by cap from the calling thread's capability bounding set. bye bestie, you will not be missed 💀

and here's the part that lowkey matters the most: any children of the calling thread will inherit the newly reduced bounding set.

like. the reduced one. not the old one. so if you were hoping to pop out a child process with the capability you just dropped? not happening. the vibe is permanently downgraded for the whole bloodline, fr fr. 🫶

---

🔥 RETURN VALUE 🔥

• On success, 0 is returned. slay, we love a zero. ✨
• On error, -1 is returned, and errno is set to indicate the error. not slay, but at least errno tells you what went wrong. 😭

---

💜 ERRORS 💜

• EINVAL — File capabilities are not enabled in the kernel. so the whole feature is just... off? not a you problem, a kernel config problem.
• EINVAL — cap does not specify a valid capability. you passed a number that isn't a real capability. that's not a capability, that's just a number, bestie. 🍓
• EPERM — The caller does not have the CAP_SETPCAP capability. you need CAP_SETPCAP to even play this game. main character energy requires main character permissions. 👑

---

🦋 VERSIONS 🦋

good news: if this low-level thing feels like a lot (it is, a little), there's a glow-up version. a higher-level interface layered on top of this operation is provided in the libcap(3) library, in the form of cap_drop_bound(3). so like, same energy, nicer wrapping paper 🎀

---

🌈 STANDARDS 🌈

Linux. that's it. that's the whole standard. 🐧

---

💅 HISTORY 💅

Linux 2.6.25. ancient in internet years, still serving. ✨

---

🔍 SEE ALSO 🔍

prctl(2), PR_CAPBSET_READ(2const), libcap(3), cap_drop_bound(3)

ngl if you're doing anything serious with this, go read PR_CAPBSET_READ(2const) too, because knowing what's still in the bounding set is kind of the whole point. iykyk 🧚

---

okay that's the page!! mwah 💖 this was brought to you by Linux man-pages 6.20, dated 2026-02-08 — go forth and drop those capabilities responsibly, bestie, and don't forget that CAP_SETPCAP check. periodt. 👑🦋🌸