cap_convert_nscap(9)

💅 cap_convert_nscap(9) — the kernel API manual, but make it make sense

okay so bestie, this is a page from the Kernel API Manual (cap_convert_nscap(9)), and it's genuinely giving "tiny function, big responsibilities" energy. let's get into it 💖

---

✨ NAME ✨

cap_convert_nscap — check vfs caps 🎀

---

🦋 SYNOPSIS 🦋

int cap_convert_nscap (struct mnt_idmap *idmap , struct dentry *dentry ,
const void **ivalue , size_t size );

like, that's the whole signature. no cap. 🫶

---

🌸 ARGUMENTS 🌸

• idmap — the idmap of the mount the inode was found from. yes, that mount. you know the one. 💫
• dentry — used to retrieve the inode to check permissions on. it's the little handle that gets you to the actual inode, lowkey the whole point. 🔥
• ivalue — the vfs caps value, and heads up bestie: this one may be modified by this function. so don't be surprised if it comes back different. 😭
• size — size of ivalue. just... the size. of ivalue. that's it. 💅

---

💜 DESCRIPTION 💜

so a user requested a write of security.capability. that's the vibe we're working with.

if needed, this function updates the xattr to change from v2 to v3, or to fixup the v3 rootid. slay, honestly — it's doing the conversion work so nobody else has to. ✨

now here's the part where you gotta pay attention, bestie 👀: if the inode has been found through an idmapped mount, the idmap of the vfsmount must be passed through idmap. this function will then take care to map the inode according to idmap before checking permissions. it's giving responsible main character energy. 🌟

on non-idmapped mounts, or if permission checking is to be performed on the raw inode, simply pass nop_mnt_idmap. that's the move. periodt. 🎀

---

⭐ RETURN ⭐

on success, return the new size. on error, return < 0. that's the whole return contract — love that for us. 💖

ngl, if you see a negative number come back, that's the error path. don't ignore it, bestie. 🙈

---

🌈 SEE ALSO 🌈

the kernel file ./security/commoncap.c, plus this whole iconic little friend group of functions:

• cap_capable_helper(9)
• cap_capable(9)
• cap_settime(9)
• cap_ptrace_access_check(9)
• cap_ptrace_traceme(9)
• cap_capget(9)
• cap_capset(9)
• cap_inode_need_killpriv(9)
• cap_inode_killpriv(9)
• kuid_root_in_ns(9)
• rootid_from_xattr(9)
• get_vfs_caps_from_disk(9)
• cap_bprm_creds_from_file(9)
• cap_inode_setxattr(9)
• cap_inode_removexattr(9)
• cap_task_fix_setuid(9)
• cap_task_setscheduler(9)
• cap_task_setioprio(9)
• cap_task_setnice(9)
• cap_task_prctl(9)
• cap_vm_enough_memory(9)
• cap_mmap_addr(9)

go read them all, iykyk 🦋

---

and that's the page!! 🫶 this little drop came from ./security, in the Kernel API Manual, dated October 2026, and it's titled cap_convert_nscap(9) — mwah, iconic, no notes. 💅✨