cap_capable(9)

💅 cap_capable — like, the Kernel API Manual, but make it make sense ✨

okay so bestie, welcome to cap_capable(9), straight outta the Kernel API Manual 🎀 this is the function that answers the one question every task is secretly asking: do i actually have this capability rn or am i delulu? 👑

---

🌸 NAME 🌸

cap_capable — literally just determining whether a task has a particular effective capability 💖 no cap, that's the whole job.

---

🦋 SYNOPSIS 🦋

int cap_capable (const struct cred *cred , struct user_namespace
*target_ns , int cap , unsigned int opts );

there she is. iconic signature, no notes. ✨

---

🍓 ARGUMENTS 🍓

• cred — the credentials you're using, bestie. that's the whole vibe check right there 🫶
• target_ns — the user namespace of the resource being accessed. like, whose house are we in 🏠
• cap — the capability you're checking for. the main character of this whole function fr fr ⭐
• opts — a bitmask of options defined in include/linux/security.h … and it's unused 💀 yeah. unused. we love a decorative parameter 🙈

---

🔥 DESCRIPTION 🔥

so the whole point: you determine whether the nominated task has the specified capability hanging out amongst its effective set. if it does → return 0. if it does not → return -ve (negative, not negative-vibes, though honestly both) 😭

NOTE WELL ⚠️ and this part is so important bestie, do not skip it: cap_capable has reverse semantics to the capable call and friends. like, the way that it's literally backwards?? 😳

let me spell it out because this trips everyone up:

• cap_capable returns an int 0 when a task has a capability 👑
• meanwhile the kernel's capable, has_ns_capability, has_ns_capability_noaudit, and has_capability_noaudit return a bool true (1) for that exact same case 💀

so 0 = yes and true/1 = yes. both yes. completely different numbers. it's giving chaos but that's the kernel for you 🌈

---

🧚 SEE ALSO 🧚

okay gather round, the whole friend group is here — kernel file ./security/commoncap.c cap_capable_helper(9), cap_settime(9), cap_ptrace_access_check(9), cap_ptrace_traceme(9), cap_capget(9), cap_capset(9), cap_inode_need_killpriv(9), cap_inode_killpriv(9), kuid_root_in_ns(9), rootid_from_xattr(9), cap_convert_nscap(9), get_vfs_caps_from_disk(9), cap_bprm_creds_from_file(9), cap_inode_setxattr(9), cap_inode_removexattr(9), cap_task_fix_setuid(9), cap_task_setscheduler(9), cap_task_setioprio(9), cap_task_setnice(9), cap_task_prctl(9), cap_vm_enough_memory(9), cap_mmap_addr(9) — all baddies, all worth a read 💅

---

and that's the tea 🍵 this page lives under ./security, dated October 2026, and it's page cap_capable(9) of the manual — so go forth, check those effective sets, and remember: 0 means yes here. slay 🎀✨💖