security_bpr...itting_creds(9)

💅 security_bprm_committing_creds(9)

okay so first things first: this page lives in the Kernel API Manual, section 9 — yes, the deep-internals section, the one your kernel-dev bestie keeps open in a spare terminal at all times. The header kinda truncates the name to security_bpr...itting_creds(9) but the real, full, iconic name is right below, slay.

---

🌸 NAME 🌸

security_bprm_committing_creds — install creds for a process during exec(). literally that's the whole vibe check: it's the hook where the new security attributes get installed while a process is mid-exec() glow-up. ✨

---

🎀 SYNOPSIS 🎀

void security_bprm_committing_creds (const struct linux_binprm *bprm );

---

🦋 ARGUMENTS 🦋

• bprm — the binary program information, bestie. that's the linux_binprm pointer, and it's carrying the whole story of the program being exec'd 🫶

---

💜 DESCRIPTION 💜

So here's the tea: this hook is where you prepare to install the new security attributes of a process that's being transformed by an execve operation. The new attributes get figured out from two things:

• the old credentials, which are pointed to by current->cred — like, who you were before the glow-up 👑
• the information set in bprm->cred by the bprm_creds_for_exec hook — like, who you're about to become 🌈

And bprm itself points to the linux_binprm structure, so everything's right there in one place. iykyk.

This hook is honestly a really good place to perform state changes on the process, ngl. The classic example: closing open file descriptors to which access will no longer be granted when the attributes are changed. like, you're about to not have permission anymore, so bestie… shut those doors before the lock changes 💀🔒

timing check: this is called immediately before commit_creds. so you're right at the threshold, the point of no return, main character energy at the door 🚪✨

---

🧚 SEE ALSO 🧚

the kernel file is ./security/security.c, and honestly the friend group here is huge — every single one of these is invited to the group chat:

lsm_file_alloc(9), lsm_backing_file_alloc(9), lsm_blob_alloc(9),
lsm_cred_alloc(9), lsm_inode_alloc(9), lsm_task_alloc(9),
lsm_ipc_alloc(9), lsm_key_alloc(9), lsm_msg_msg_alloc(9),
lsm_bdev_alloc(9), lsm_bpf_map_alloc(9), lsm_bpf_prog_alloc(9),
lsm_bpf_token_alloc(9), lsm_superblock_alloc(9), lsm_fill_user_ctx(9),
security_binder_set_context_mgr(9), security_binder_transaction(9),
security_binder_transfer_binder(9), security_binder_transfer_file(9),
security_ptrace_access_check(9), security_ptrace_traceme(9),
security_capget(9), security_capset(9), security_capable(9),
security_quotactl(9), security_quota_on(9), security_syslog(9),
security_settime64(9), security_vm_enough_memory_mm(9),
security_bprm_creds_for_exec(9), security_bprm_creds_from_file(9),
security_bprm_check(9), security_bprm_committed_creds(9),
security_fs_context_submount(9), security_fs_context_dup(9),
security_fs_context_parse_param(9), security_sb_alloc(9),
security_sb_delete(9), security_sb_free(9), security_free_mnt_opts(9),
security_sb_eat_lsm_opts(9), security_sb_mnt_opts_compat(9),
security_sb_remount(9), security_sb_kern_mount(9),
security_sb_show_options(9), security_sb_statfs(9),
security_sb_mount(9), security_sb_umount(9), security_sb_pivotroot(9),
security_sb_set_mnt_opts(9), security_sb_clone_mnt_opts(9),
security_move_mount(9), security_path_notify(9),
security_inode_alloc(9), security_inode_free(9),
security_dentry_init_security(9), security_dentry_create_files_as(9),
security_inode_init_security(9), security_inode_init_security_anon(9),
security_path_mknod(9), security_path_post_mknod(9),
security_path_mkdir(9), security_path_rmdir(9), security_path_unlink(9),
security_path_symlink(9), security_path_link(9),
security_path_rename(9), security_path_truncate(9),
security_path_chmod(9), security_path_chown(9), security_path_chroot(9),
security_inode_create(9), security_inode_post_create_tmpfile(9),
security_inode_link(9), security_inode_unlink(9),
security_inode_symlink(9), security_inode_mkdir(9),
security_inode_rmdir(9), security_inode_mknod(9),
security_inode_rename(9), security_inode_readlink(9),
security_inode_follow_link(9), security_inode_permission(9),
security_inode_setattr(9), security_inode_post_setattr(9),
security_inode_getattr(9), security_inode_setxattr(9),
security_inode_set_acl(9), security_inode_post_set_acl(9),
security_inode_get_acl(9), security_inode_remove_acl(9),
security_inode_post_remove_acl(9), security_inode_post_setxattr(9),
security_inode_getxattr(9), security_inode_listxattr(9),
security_inode_removexattr(9), security_inode_post_removexattr(9),
security_inode_file_setattr(9), security_inode_file_getattr(9),
security_inode_need_killpriv(9), security_inode_killpriv(9),
security_inode_getsecurity(9), security_inode_setsecurity(9),
security_inode_listsecurity(9), security_inode_getlsmprop(9),
security_inode_copy_up(9), security_inode_copy_up_xattr(9),
security_inode_setintegrity(9), security_kernfs_init_security(9),
security_file_permission(9), security_file_alloc(9),
security_file_release(9), security_file_free(9),
security_backing_file_alloc(9), security_backing_file_free(9),
security_file_ioctl(9), security_file_ioctl_compat(9),
security_mmap_file(9), security_mmap_backing_file(9),
security_mmap_addr(9), security_file_mprotect(9), security_file_lock(9),
security_file_fcntl(9), security_file_set_fowner(9),
security_file_send_sigiotask(9), security_file_receive(9),
security_file_open(9), security_file_post_open(9),
security_file_truncate(9), security_task_alloc(9),
security_task_free(9), security_cred_alloc_blank(9),
security_cred_free(9), security_prepare_creds(9),
security_transfer_creds(9), security_cred_getsecid(9),
security_cred_getlsmprop(9), security_kernel_act_as(9),
security_kernel_create_files_as(9), security_kernel_module_request(9),
security_kernel_read_file(9), security_kernel_post_read_file(9),
security_kernel_load_data(9), security_kernel_post_load_data(9),
security_task_fix_setuid(9), security_task_fix_setgid(9),
security_task_fix_setgroups(9), security_task_setpgid(9),
security_task_getpgid(9), security_task_getsid(9),
security_current_getlsmprop_subj(9), security_task_getlsmprop_obj(9),
security_task_setnice(9), security_task_setioprio(9),
security_task_getioprio(9), security_task_prlimit(9),
security_task_setrlimit(9), security_task_setscheduler(9),
security_task_getscheduler(9), security_task_movememory(9),
security_task_kill(9), security_task_prctl(9),
security_task_to_inode(9), security_create_user_ns(9),
security_ipc_permission(9), security_ipc_getlsmprop(9),
security_msg_msg_alloc(9), security_msg_msg_free(9),
security_msg_queue_alloc(9), security_msg_queue_free(9),
security_msg_queue_associate(9), security_msg_queue_msgctl(9),
security_msg_queue_msgsnd(9), security_msg_queue_msgrcv(9),
security_shm_alloc(9), security_shm_free(9), security_shm_associate(9),
security_shm_shmctl(9), security_shm_shmat(9), security_sem_alloc(9),
security_sem_free(9), security_sem_associate(9), security_sem_semctl(9),
security_sem_semop(9), security_d_instantiate(9),
security_getselfattr(9), security_setselfattr(9),
security_getprocattr(9), security_setprocattr(9),
security_ismaclabel(9), security_secid_to_secctx(9),
security_lsmprop_to_secctx(9), security_secctx_to_secid(9),
security_release_secctx(9), security_inode_invalidate_secctx(9),
security_inode_notifysecctx(9), security_inode_setsecctx(9),
security_inode_getsecctx(9), security_post_notification(9),
security_watch_key(9), security_netlink_send(9),
security_unix_stream_connect(9), security_unix_may_send(9),
security_socket_create(9), security_socket_post_create(9),
security_socket_socketpair(9), security_socket_bind(9),
security_socket_connect(9), security_socket_listen(9),
security_socket_accept(9), security_socket_sendmsg(9),
security_socket_recvmsg(9), security_socket_getsockname(9),
security_socket_getpeername(9), security_socket_getsockopt(9),
security_socket_setsockopt(9), security_socket_shutdown(9),
security_sock_rcv_skb(9), security_socket_getpeersec_stream(9),
security_socket_getpeersec_dgram(9), lsm_sock_alloc(9),
security_sk_alloc(9), security_sk_free(9), security_sk_clone(9),
security_sk_classify_flow(9), security_req_classify_flow(9),
security_sock_graft(9), security_inet_conn_request(9),
security_inet_csk_clone(9), security_inet_conn_established(9),
security_secmark_relabel_packet(9), security_secmark_refcount_inc(9),
security_secmark_refcount_dec(9), security_tun_dev_alloc_security(9),
security_tun_dev_free_security(9), security_tun_dev_create(9),
security_tun_dev_attach_queue(9), security_tun_dev_attach(9),
security_tun_dev_open(9), security_sctp_assoc_request(9),
security_sctp_bind_connect(9), security_sctp_sk_clone(9),
security_sctp_assoc_established(9), security_mptcp_add_subflow(9),
security_unix_find(9), security_ib_pkey_access(9),
security_ib_endport_manage_subnet(9), security_ib_alloc_security(9),
security_ib_free_security(9), security_xfrm_policy_alloc(9),
security_xfrm_policy_clone(9), security_xfrm_policy_free(9),
security_xfrm_policy_delete(9), security_xfrm_state_alloc(9),
security_xfrm_state_alloc_acquire(9), security_xfrm_state_delete(9),
security_xfrm_state_free(9), security_xfrm_policy_lookup(9),
security_xfrm_state_pol_flow_match(9), security_xfrm_decode_session(9),
security_key_alloc(9), security_key_free(9), security_key_permission(9),
security_key_getsecurity(9), security_key_post_create_or_update(9),
security_audit_rule_init(9), security_audit_rule_known(9),
security_audit_rule_free(9), security_audit_rule_match(9),
security_bpf(9), security_bpf_map(9), security_bpf_prog(9),
security_bpf_map_create(9), security_bpf_prog_load(9),
security_bpf_token_create(9), security_bpf_token_cmd(9),
security_bpf_token_capable(9), security_bpf_map_free(9),
security_bpf_prog_free(9), security_bpf_token_free(9),
security_locked_down(9), security_bdev_alloc(9), security_bdev_free(9),
security_bdev_setintegrity(9), security_perf_event_open(9),
security_perf_event_alloc(9), security_perf_event_free(9),
security_perf_event_read(9), security_perf_event_write(9),
security_uring_override_creds(9), security_uring_sqpoll(9),
security_uring_cmd(9), security_uring_allowed(9),
security_initramfs_populated(9)

like… it's giving "everyone and their cousin showed up to the function" 😭 but every one of them is real and you can go read them all, no cap 🫶

---

🌸 and that's the page, bestie! this one's from ./security, dated October 2026, and it goes out to the whole security_bpr...itting_creds(9) crew. mwah, go read your creds 💖🎀✨