verify_root_map(9)

💖 NAME 💖

okay so this is verify_root_map(9) from the Kernel API Manual, and it's literally the function that checks the uid 0 mapping. bestie, it's giving "are you actually allowed to do this" energy 🔥

---

✨ SYNOPSIS ✨

bool verify_root_map (const struct file *file , struct user_namespace
*map_ns , struct uid_gid_map *new_map );

---

🎀 ARGUMENTS 🎀

• file — the idmapping file, bestie. that's the file in question 💅
• map_ns — the user namespace of the target process 👑
• new_map — the requested idmap, aka the map being asked for 🦋

---

🌸 DESCRIPTION 🌸

so here's the tea: if a process requests mapping parent uid 0 into the new ns, this function verifies that the process writing the map had the CAP_SETFCAP capability. why? because the target process will be able to write fscaps that are valid in ancestor user namespaces. no cap, no mapping — periodt 💀✨

---

🌈 RETURN 🌈

• true if the mapping is allowed 💖
• false if not 🙈

---

🫶 SEE ALSO 🫶

• Kernel file ./kernel/user_namespace.c
• make_kuid(9)
• from_kuid(9)
• from_kuid_munged(9)
• make_kgid(9)
• from_kgid(9)
• from_kgid_munged(9)
• make_kprojid(9)
• from_kprojid(9)
• from_kprojid_munged(9)

---

shoutout to ./kernel for the source/version vibe and October 2026 for the date stamp — iconic, no cap 💜🎀