netlink_ns_capable(9)

🎀 netlink_ns_capable(9) 🎀

okay bestie, this page is from the Kernel API Manual and it’s all about netlink_ns_capable(9) — the general netlink message capability test. It’s giving very specific kernel security side-quest energy, and we’re gonna read every bit of it. 💅✨

🌸 NAME 🌸

netlink_ns_capable — the general netlink message capability test. No cap, except literally cap is an argument. 😌

✨ SYNOPSIS ✨

bool netlink_ns_capable (const struct sk_buff *skb , struct
       user_namespace *user_ns , int cap );

🫶 ARGUMENTS 🫶

• skb — the socket buffer holding a netlink command from userspace. bestie is carrying the message. 📦
• user_ns — the user namespace of the capability to use. that’s the namespace vibe check. 🌈
• cap — the capability to use. yes, the cap. the moment. 👑

💖 DESCRIPTION 💖

okay so the test is: did the opener of the socket we received the message from had — and yes, the page literally just says had, I’m not making that up 😭 — when the netlink socket was created, and does the sender of the message have the capability cap in the user namespace user_ns? that’s the check. periodt. ✨

lowkey the sentence is doing the most, but the details are the details: opener of the socket, the message we received, when the netlink socket was created, sender of the message, capability cap, user namespace user_ns. all of it stays. 🫡

👀 SEE ALSO 👀

• Kernel file ./net/netlink/af_netlink.c — also go look at __netlink_ns_capable(9), netlink_capable(9), netlink_net_capable(9), netlink_set_err(9), netlink_change_ngroups(9), and nlmsg_notify(9). iykyk 🔥

mwah 💋 sign-off time: source/version is ./net/netlink, date is October 2026, and the page is netlink_ns_capable(9). bye bestie, go be capable! 🦋💜