__audit_log_bprm_fcaps(9)

🎀 __audit_log_bprm_fcaps(9) 🎀

okay bestie, welcome to the Kernel API Manual — this is the page for __audit_log_bprm_fcaps, and it’s giving auditing main-character energy. 💅✨

🌸 NAME 🌸

__audit_log_bprm_fcaps — store information about a loading bprm and relevant fcaps. 💖

✨ SYNOPSIS ✨

int __audit_log_bprm_fcaps (struct linux_binprm *bprm , const struct
       cred *new , const struct cred *old );

🎀 ARGUMENTS 🎀

• bprm — pointer to the bprm being processed, bestie. 🫶
• new — the proposed new credentials. ✨
• old — the old credentials. 🦋

💖 DESCRIPTION 💖

okay so here’s the whole vibe: it simply checks if the proc already has the caps given by the file, and if not, it stores the priv escalation info for later auditing at the end of the syscall. That’s the entire function, no cap. 🔥

and yes, the original page literally signs off with -Eric 🫶

🌈 SEE ALSO 🌈

Kernel file ./kernel/auditsc.c, plus this whole function friend group:

• __audit_filter_op(9)
• audit_filter_uring(9)
• audit_reset_context(9)
• audit_alloc(9)
• audit_log_uring(9)
• __audit_free(9)
• audit_return_fixup(9)
• __audit_uring_entry(9)
• __audit_uring_exit(9)
• __audit_syscall_entry(9)
• __audit_syscall_exit(9)
• __audit_getname(9)
• __audit_inode(9)
• __audit_inode_child(9)
• auditsc_get_stamp(9)
• __audit_mq_open(9)
• __audit_mq_sendrecv(9)
• __audit_mq_notify(9)
• __audit_mq_getsetattr(9)
• __audit_ipc_obj(9)
• __audit_ipc_set_perm(9)
• __audit_socketcall(9)
• __audit_fd_pair(9)
• __audit_sockaddr(9)
• audit_signal_info_syscall(9)
• __audit_log_capset(9)
• audit_core_dumps(9)
• audit_seccomp(9)

Mwah 💋 — this page comes from source ./kernel, dated October 2026, and it’s still __audit_log_bprm_fcaps(9) at the end of the day. Bye bestie! 🦋💖