has_capability_noaudit(9)

💅 has_capability_noaudit — the kernel API manual, bestie edition 🎀

okay so real talk, this is page has_capability_noaudit(9) from the Kernel API Manual, and it's genuinely one of the shorter ones so we can absolutely get through it together. stay with me 💖

---

✨ NAME ✨

has_capability_noaudit — does a task have a capability (unaudited) in the initial user ns

like, the whole vibe of this function is "check the permission, but don't tell anyone about it" 🤫

---

🦋 SYNOPSIS 🦋

bool has_capability_noaudit (struct task_struct *t , int cap );

that's it. that's the whole signature. two args, returns a bool, no cap fr fr 🧚

---

🌸 ARGUMENTS 🌸

• t — the task in question. yes literally the task you're side-eyeing 👀
• cap — the capability to be tested for. the thing you wanna know if they have or not 💅

---

⭐ DESCRIPTION ⭐

Returns true if the specified task has the given superior capability currently in effect to init_user_ns, and false if not. don't write an audit message for the check, that's the whole point — hence the noaudit in the name, iykyk 🙈

⚠️ heads up, bestie: note that this does not set PF_SUPERPRIV on the task. like, at all. don't come for me, that's just how it is 😭

---

🔥 SEE ALSO 🔥

all the siblings and cousins of this function, in the kernel file ./kernel/capability.c:

• sys_capget(9)
• sys_capset(9)
• has_ns_capability(9)
• has_ns_capability_noaudit(9)
• ns_capable(9)
• ns_capable_noaudit(9)
• ns_capable_setid(9)
• capable(9)
• capable_noaudit(9)
• file_ns_capable(9)
• privileged_wrt_inode_uidgid(9)
• capable_wrt_inode_uidgid(9)
• ptracer_capable(9)

whole friend group honestly, they all ate 👑

---

this page lives in ./kernel, dated October 2026, and it's the has_capability_noaudit(9) page specifically 🫶 that's the whole thing, you understood it, slay, bye bestie 💜✨