ns_capable(9)

✨ ns_capable(9) ✨

okay bestie, welcome to the Kernel API Manual — today’s main character is ns_capable(9), and we’re gonna get you comfy with it 💖

🎀 NAME 🎀

• ns_capable — determine if the current task has a superior capability in effect ✨

🌸 SYNOPSIS 🌸

bool ns_capable (struct user_namespace *ns , int cap );

💅 ARGUMENTS 💅

• ns — the usernamespace where we want the capability to be in effect 🫶
• cap — the capability we’re testing for 🔍

🦋 DESCRIPTION 🦋

So here’s the tea: this returns true if the current task has the given superior capability currently available for use, and false if not. No cap, that’s the whole vibe check 😌

It also sets PF_SUPERPRIV on the task if the capability is available — and it does that on the assumption that it’s about to be used. So yeah, it’s not just peeking at the capability, it’s also flagging the task like “bestie is about to use this” 💅

🌈 SEE ALSO 🌈

Kernel file: ./kernel/capability.c — and these iconic little references too 👑

• sys_capget(9)
• sys_capset(9)
• has_ns_capability(9)
• has_ns_capability_noaudit(9)
• has_capability_noaudit(9)
• ns_capable_noaudit(9)
• ns_capable_setid(9)
• capable(9)
• capable_noaudit(9)
• file_ns_capable(9)
• privileged_wrt_inode_uidgid(9)
• capable_wrt_inode_uidgid(9)
• ptracer_capable(9)

signing off from ./kernel, stamped October 2026, and this was the ns_capable(9) page — slay and goodbye 💖🦋