cap_capset(9)

📦 version 7.3.1, in nixpkgs unstable

💅 cap_capset — like, the kernel API manual, bestie ✨

okay so we're in cap_capset(9) territory, which is the kernel API manual, and honestly? this one is short but it ate. it's all about validating and applying proposed changes to current's capabilities. let's get into it 🫶

🌸 NAME 🌸

cap_capset — validate and apply proposed changes to current's capabilities ✨

💖 SYNOPSIS 💖

int cap_capset (struct cred *new , const struct cred *old , const
kernel_cap_t *effective , const kernel_cap_t *inheritable , const
kernel_cap_t *permitted );

like, that's the whole signature, no cap. five arguments, one int coming back at you 💅

🎀 ARGUMENTS 🎀

  • new — the proposed new credentials; alterations should be made here. this is the main character, the glow-up happens in this struct 👑
  • old — the current task's current credentials. the before pic, basically 📸
  • effective — a pointer to the proposed new effective capabilities set ✨
  • inheritable — a pointer to the proposed new inheritable capabilities set 🧚
  • permitted — a pointer to the proposed new permitted capabilities set 💜

🦋 DESCRIPTION 🦋

okay so what does this function actually do? it validates and applies a proposed mass change to the current process's capability sets. mass change, bestie — we're not tweaking one flag, we're doing a whole wardrobe swap 👗✨

the changes are made to the proposed new credentials, and — assuming no error — will be committed by the caller of LSM. no error, no problem; error, and, well, it's giving "not today" 💀

ngl, the "assuming no error" part is doing a lot of heavy lifting there. if there is an error, the commit doesn't happen — that's the deal 🫶

🔥 SEE ALSO 🔥

the kernel file is at ./security/commoncap.c, and here's the whole friend group, fr fr:

like, that's the entire squad. collect them all 🌈⭐

🍓 the cute sign-off 🍓

this iconic little page comes from ./security — that's the source, bestie — and it's dated October 2026, version cap_capset(9). so like, future vibes but make it kernel 💀✨

go forth and validate those capabilities, queen. periodt 💅👑

📦 where this page comes from