trace_cap_capable(9)

💅 trace_cap_capable(9) — a Kernel API Manual moment ✨

okay bestie, so this is a page from the Kernel API Manual, and it's about trace_cap_capable — literally the little hook that fires right after the kernel has figured out whether a task actually holds a particular effective capability. it's giving "backstage pass to the permission check" energy 🎟️

---

🌸 NAME 🌸

trace_cap_capable — called after it's determined if a task has a particular effective capability 💖

---

⭐ SYNOPSIS ⭐

void trace_cap_capable (const struct cred *cred , struct user_namespace
*target_ns , const struct user_namespace *capable_ns , int cap , int ret
);

no cap, that's the whole signature 🫶

---

🎀 ARGUMENTS 🎀

• cred — the credentials being used, iykyk 🔑
• target_ns — the user namespace of the resource that's being accessed 🌐
• capable_ns — the user namespace where the credential actually provides the capability to access the targeted resource. heads up bestie: this one is NULL if ret is not 0 👀
• cap — the capability we're checking for 💅
• ret — the return value of the check: 0 if it does, -ve if it does not 😭

---

🦋 DESCRIPTION 🦋

it lets you trace calls to cap_capable in commoncap.c — that's it, that's the whole vibe. main character tracepoint energy 👑

---

💜 SEE ALSO 💜

• Kernel file ./include/trace/events/capability.h 📁

---

and that's the whole page, bestie — no crumbs left behind 🍓

signing off from ./include/trace/events, dated October 2026, page trace_cap_capable(9) — slay, go trace some capabilities, periodt 💅✨🎀