in_group_or_capable(9)

💅 in_group_or_capable(9) — like, the Kernel API Manual edition 🎀

okay bestie, sit down, because today we're learning about in_group_or_capable — yes it's a mouthful, yes it slays, and yes it's literally just asking "are you allowed to keep that setgid bit or not" 🦋

---

✨ NAME ✨

in_group_or_capable — check whether the caller is CAP_FSETID privileged 💫

---

🌸 SYNOPSIS 🌸

bool in_group_or_capable (struct mnt_idmap *idmap , const struct inode
       *inode , vfsgid_t vfsgid );

---

🎀 ARGUMENTS 🎀

• idmap — the idmap of the mount the inode was found from. the receipts, basically 🧾
• inode — the inode we're checking. the main character fr 👑
• vfsgid — the new/current vfsgid of the inode. the gid in question 💜

---

⭐ DESCRIPTION ⭐

so here's the vibe check: check whether vfsgid is in the caller's group list or whether the caller is privileged with CAP_FSETID over inode. that's it, that's the whole function 🫶

why do we care? because this is how you figure out whether the setgid bit can be kept or must be dropped — like, highkey important decision energy 🔥

---

🌈 RETURN 🌈

• true — if the caller is sufficiently privileged 💖
• false — if not 🙈

no in-between, no "it depends", just a clean boolean slay ✨

---

🦋 SEE ALSO 🦋

the whole inode friend group, and honestly they're all icons:

• inode_init_always_gfp(9), alloc_inode(9), drop_nlink(9), clear_nlink(9), set_nlink(9), inc_nlink(9)
• inode_sb_list_add(9), __insert_inode_hash(9), __remove_inode_hash(9), evict_inodes(9), new_inode(9), unlock_new_inode(9)
• lock_two_nondirectories(9), unlock_two_nondirectories(9), inode_insert5(9), iget5_locked(9), iget5_locked_rcu(9), iget_locked(9)
• iunique(9), ihold(9), ilookup5_nowait(9), ilookup5(9), ilookup(9), find_inode_nowait(9)
• find_inode_rcu(9), find_inode_by_ino_rcu(9), iput(9), iput_not_last(9), bmap(9), inode_update_time(9)
• generic_update_time(9), atime_needs_update(9), file_remove_privs(9), current_time(9), file_update_time(9), file_modified_flags(9)
• file_modified(9), kiocb_modified(9), inode_init_owner(9), inode_owner_or_capable(9), inode_dio_wait(9), timestamp_truncate(9)
• inode_set_ctime_current(9), inode_set_ctime_deleg(9), mode_strip_sgid(9), dump_inode(9)

and the source of truth itself: the kernel file ./fs/inode.c 📁

---

ngl bestie, if you got this far you're officially a filesystem girlie now 💅🧚

okay that's the whole page!! this little gem lives in ./fs in the kernel tree, it's the October 2026 version, and it's filed under in_group_or_capable(9) in the Kernel API Manual. mwah, go check your setgid bits responsibly 😭💖🎀