scx_bpf_sub_grant(9)

💅 scx_bpf_sub_grant(9) — the kernel API manual, bestie edition 💅

okay so this is a page from the Kernel API Manual (scx_bpf_sub_grant(9), section 9, kernel functions, iykyk) and it's genuinely such a slay little kfunc. let me walk you through it 🫶

---

✨ NAME ✨

scx_bpf_sub_grant — grant @caps on a cmask's cids to a direct child 💖

like, the whole personality of this function is "give the child caps, but only on the cids you're allowed to give them on". obsessed.

---

🦋 SYNOPSIS 🦋

__bpf_kfunc s32 scx_bpf_sub_grant (u64 cgroup_id , u64 caps , const
struct scx_cmask *cmask__arena , struct scx_cmask
*denied_out__arena__nullable , const struct bpf_prog_aux *aux );

that's the whole signature, no notes, copy it exactly please 🎀

---

🌸 ARGUMENTS 🌸

• cgroup_id — the cgroup id of the direct child sub-sched. direct child only, bestie, we're not doing deep recursion here ✨
• caps — a bitmask of SCX_CAP_* to grant. bitmask!! so you can stack several caps in one go 💅
• cmask__arena — the cid cmask you're granting caps on. the vibe check target, basically.
• denied_out__arena__nullable — optional cmask that accumulates the refused cids. optional!! nullable!! the __nullable is literally right there in the name 🫶
• aux — implicit BPF argument. it's just there, main character energy, we don't question it 💀

---

🔥 DESCRIPTION 🔥

okay so here's the tea ☕ — a cid inside cmask__arena gets granted to the child only if the parent holds every requested cap on it. every single one. no partial slay. it's giving all-or-nothing and honestly? iconic.

refused cids get OR'd into the denied mask — but only when it's provided. so if you didn't pass denied_out__arena__nullable, no mask for you 🙈

⚠️ also important: refusals that fall outside the denied mask's range are not recorded. like, they just don't show up. the mask has a range and it stays in its lane.

why all-or-nothing, you ask? because it keeps the caller-visible result binary per cid — granted or not granted, that's it. so the denied mask is literally one mask to interpret instead of a whole per-cap matrix situation 😭 nothing worse than a matrix at 3am, we don't need that.

return values, periodt:

• returns 0 on full success — every cid ate 💅
• returns -EPERM if any cid was refused — even one refusal and it's -EPERM, no cap
• returns a negative errno on other failures

---

👑 SEE ALSO 👑

kernel file ./kernel/sched/ext/sub.c and the entire extended family, all of them, in order, no skips:

scx_skip_subtree_pre(9), scx_next_descendant_pre(9), scx_rescue_charge(9), scx_rescue_end(9), scx_rescue_keep(9), scx_rescue_accrue(9), scx_rescue_admit(9), scx_rescue_try_admit(9), scx_rescue_check_overload(9), scx_rescue_timerfn(9), scx_resolve_local_dsq(9), queue_sync_ecaps(9), scx_process_sync_ecaps(9), scx_unbypass_replay_ecaps(9), scx_discard_stale_ecaps_syncs(9), scx_rehome_task(9), scx_punt_task(9), scx_cgroup_claim_subtree(9), scx_cgroup_return_subtree(9), scx_cgroup_task_migrating(9), scx_cgroup_task_migrated(9), scx_cgroup_task_migrate_canceled(9), scx_bpf_sub_dispatch(9), scx_bpf_sub_revoke(9), scx_bpf_sub_caps(9), scx_bpf_sub_kill_bstr(9)

go read them all, they're all slaying in their own way 🦋💜

---

and that's the page!! brought to you by the kernel file ./kernel/sched/ext, dated October 2026, and yes the page itself is scx_bpf_sub_grant(9) — mwah, drink water, read your manpages, bye bestie 💖✨🎀