CAPNG_LOCK(3)

💖 CAPNG_LOCK(3) 💖

okay bestie, we're in the Libcap-ng API section and this one is literally about locking your process's capability settings so nobody sneaks back in. it's capng_lock, and she's iconic. 🎀

---

✨ NAME ✨

capng_lock — lock the current process capabilities settings 🔒

---

🌸 SYNOPSIS 🌸

#include <cap-ng.h>

int capng_lock(void);

---

🦋 DESCRIPTION 🦋

so capng_lock takes steps to stop children of the current process from regaining full privileges if the uid is 0. yes, that's the whole vibe — no privilege glow-ups for the kids.

you should call this while you're holding the CAP_SETPCAP capability in the kernel, okay? that's the price of admission. 💅

if the kernel permits it, this function will do all of the following:

• Set the NOROOT option on for PR_SET_SECUREBITS.
• Set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS.
• Set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS.
• Set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS.

now, important, bestie — it does not enable PR_SET_KEEPCAPS or the KEEP_CAPS/KEEP_CAPS_LOCKED securebits. not her job, not her problem. 🙈

and the way she's respectful about it: existing securebits set by the caller are preserved, including securebits that were added after this version of libcap-ng was built. so nothing of yours gets thrown away. periodt. ✨

---

💀 RETURN VALUE 💀

she returns 0 on success and a negative number on failure. specifically:

• -1 means a failure reading or updating the securebits.
• -2 means failure setting PR_SET_NO_NEW_PRIVS.

and these are additive, meaning -3 is a failure of both. both at once? that's a vibe check fail fr fr. 😭

---

🌈 SEE ALSO 🌈

• capng_apply(3)
• prctl(2)
• capabilities(7)

---

👑 AUTHOR 👑

Steve Grubb 💜

---

and that's the whole page, bestie! this was the Libcap-ng API manual, brought to you by Red Hat, dated Mar 2026. go lock those capabilities down and slay responsibly. 🫶🌸💅