get_vfs_caps_from_disk(9)

get_vfs_caps_from_disk(9) — Kernel API Manual, bestie edition ✨

NAME 🌸

get_vfs_caps_from_disk — retrieve vfs caps from disk, and yes this is the whole vibe 💅

---

SYNOPSIS 🦋

int get_vfs_caps_from_disk (struct mnt_idmap *idmap , const struct
       dentry *dentry , struct cpu_vfs_cap_data *cpu_caps );

---

ARGUMENTS 🎀

• idmap — idmap of the mount the inode was found from. that’s the mount’s idmap, okay bestie?
• dentry — dentry from which inode is retrieved. you hand over the dentry, and the inode gets retrieved from it
• cpu_caps — vfs capabilities. this is where the vfs capabilities live

---

DESCRIPTION 🫶

Okay so this function extracts the on-exec-apply capability sets for an executable file. Iconic behavior, honestly. ✨

If the inode has been found through an idmapped mount, the idmap of the vfsmount must be passed through idmap. This function will then take care to map the inode according to idmap before checking permissions. the way it maps before checking permissions? slay. 💅

On non-idmapped mounts, or if permission checking is to be performed on the raw inode, simply pass nop_mnt_idmap. Periodt. 🎀

---

SEE ALSO 👑

Kernel file ./security/commoncap.c — yes, that’s the source file. The SEE ALSO squad is literally right here, iykyk:

• cap_capable_helper(9)
• cap_capable(9)
• cap_settime(9)
• cap_ptrace_access_check(9)
• cap_ptrace_traceme(9)
• cap_capget(9)
• cap_capset(9)
• cap_inode_need_killpriv(9)
• cap_inode_killpriv(9)
• kuid_root_in_ns(9)
• rootid_from_xattr(9)
• cap_convert_nscap(9)
• cap_bprm_creds_from_file(9)
• cap_inode_setxattr(9)
• cap_inode_removexattr(9)
• cap_task_fix_setuid(9)
• cap_task_setscheduler(9)
• cap_task_setioprio(9)
• cap_task_setnice(9)
• cap_task_prctl(9)
• cap_vm_enough_memory(9)
• cap_mmap_addr(9)

---

_signed off from ./security, dated October 2026 — stay caps-locked and hydrated, bestie 💖🧚_