ns_capable_setid(9)

💅 ns_capable_setid(9) — the linux kernel API manual, but make it make sense 🫶

okay bestie, so this one's a kernel API manual page (yes, section 9, the fancy kernel-internals one) and it's literally about checking whether the current task has a capability, but like… the setid/setgroups flavour ✨ stay with me, it's gonna slay.

---

🎀 NAME 🎀

ns_capable_setid — determines if the current task has a superior capability in effect, while signalling that this check is being done from inside a setid or setgroups syscall. iykyk 💅

---

✨ SYNOPSIS ✨

bool ns_capable_setid (struct user_namespace *ns , int cap );

that's it. that's the whole vibe check. two args, one bool back. 🦋

---

🌸 ARGUMENTS 🌸

• ns — the usernamespace we want the capability in 👑 (like, which namespace are we asking about, bestie)
• cap — the capability to be tested for 🔍

---

💖 DESCRIPTION 💖

so the tea is: this returns true if the current task has the given superior capability currently available for use, and false if not. no cap, that's the whole deal. ⭐

and here's the little detail that matters — it sets PF_SUPERPRIV on the task if the capability is available, on the assumption that it's about to be used. so like, it's not just peeking at the answer, it's marking the task as "yeah this one's got privileges and is about to use them" 🫶

⚠️ heads up: this is specifically the version that signals the check is happening from within a setid or setgroups syscall. don't just swap it in for any old capability check, bestie — the signalling is the whole point 💀

---

🌈 SEE ALSO 🌈

all my faves, in a little list, fr fr:

• kernel file ./kernel/capability.c
• sys_capget(9)
• sys_capset(9)
• has_ns_capability(9)
• has_ns_capability_noaudit(9)
• has_capability_noaudit(9)
• ns_capable(9)
• ns_capable_noaudit(9)
• capable(9)
• capable_noaudit(9)
• file_ns_capable(9)
• privileged_wrt_inode_uidgid(9)
• capable_wrt_inode_uidgid(9)
• ptracer_capable(9)

like, the whole capability friend group 💜

---

and that's the page, bestie! 🎀 this one lives in ./kernel (that's the source/version bit), dated October 2026, and it's filed under ns_capable_setid(9) in the section 9 kernel API manual. go forth and capability-check responsibly 🧚‍♀️💖🍓