sys_capset(9)

💅 sys_capset — the kernel api manual, but make it make sense

okay so real talk, today we're learning sys_capset(9) from the Kernel API Manual and honestly? it's lowkey a glow-up moment for your process's permissions. bestie, let's get into it 🎀

---

✨ NAME ✨

sys_capset — set capabilities for a process or (*) a group of processes

like, it's literally the function that hands out (or takes away) capability vibes. and yes, that asterisk on "group of processes" is doing a little 😭 because...

---

🦋 SYNOPSIS 🦋

long sys_capset (cap_user_header_t header , const cap_user_data_t data
);

look at that signature. long return, two args, iconic. no cap.

---

🌸 ARGUMENTS 🌸

• header — pointer to struct that contains capability version and target pid data. it's giving "who am I doing this for and which version of the rules are we playing by" energy.
• data — pointer to struct that contains the effective, permitted, and inheritable capabilities. the actual content, the main character of the two structs ngl.

---

🔥 DESCRIPTION 🔥

okay so here's the tea: it sets capabilities for the current process only. that's it. that's the whole vibe.

and the ability to do it for any other process(es)? deprecated and removed. gone. no thoughts, empty head, deleted. the (*) in the name is basically a little historical ghost 👻. so if you showed up hoping to buff some other process's capabilities, sorry bestie, that door is nailed shut.

the restrictions on setting capabilities are specified as: (and yes, these are word-for-word the rules, I'm not summarising, I would never)

• I: any raised capabilities must be a subset of the old permitted
• P: any raised capabilities must be a subset of the old permitted
• E: must be set to a subset of new permitted

💀 lowkey read those carefully — it's all about subsets. you can't just mint new powers out of thin air. you can only pass along what was already permitted, and the new effective set has to stay inside the new permitted set. the vibe check is strict.

Returns 0 on success and < 0 on error. (yes, literally < 0, not a specific errno, that's just how it's written here, don't come for me 🫶)

---

👑 SEE ALSO 👑

go read these next, they're all in their flop era of being underappreciated:

• Kernel file ./kernel/capability.c — the source, the origin story, the mothership
• sys_capget(9)
• has_ns_capability(9)
• has_ns_capability_noaudit(9)
• has_capability_noaudit(9)
• ns_capable(9)
• ns_capable_noaudit(9)
• ns_capable_setid(9)
• capable(9)
• capable_noaudit(9)
• file_ns_capable(9)
• privileged_wrt_inode_uidgid(9)
• capable_wrt_inode_uidgid(9)
• ptracer_capable(9)

that's the whole squad, all 13 of them + the kernel file. read them, love them, cite them in your commit messages 💜

---

and that's the page!! mwah 💋 this lil kernel api manual dropped from ./kernel in October 2026 — go forth and set those capabilities responsibly, bestie 🌈⭐🍓