Seth Woolley's Man Viewer

capget(2) - capget, capset, capget, capset - set/get process capabilities - man 2 capget

([section] manual, -k keyword, -K [section] search, -f whatis)
man plain no title

CAPGET(2)                  Linux Programmer's Manual                 CAPGET(2)



NAME
       capget, capset - set(7,n,1 builtins)/get process capabilities

SYNOPSIS
       #undef _POSIX_SOURCE
       #include <sys/capability.h>

       int capget(cap_user_header_t hdrp, cap_user_data_t datap);

       int capset(cap_user_header_t hdrp, const cap_user_data_t datap);

DESCRIPTION
       As of Linux 2.2, the power of the superuser (root) has been partitioned
       into a set(7,n,1 builtins) of discrete capabilities.  Every process has a set(7,n,1 builtins) of effec-
       tive  capabilities  identifying which capabilities (if(3,n) any) it may cur-
       rently exercise.  Every process also has a set(7,n,1 builtins) of inheritable capabili-
       ties that may be passed through an execve(2) call, and a set(7,n,1 builtins) of permit-
       ted capabilities that it can make effective or inheritable.

       These two functions are the raw(3x,7,8,3x cbreak) kernel interface for getting  and  set-
       ting  capabilities.  Not only are these system calls specific to Linux,
       but the kernel API is likely to change and use of these  functions  (in(1,8)
       particular  the  format of the cap_user_*_t types) is subject to change
       with each kernel revision.

       The portable interfaces are  cap_set_proc(3)  and  cap_get_proc(3);  if(3,n)
       possible  you should use those interfaces in(1,8) applications.  If you wish
       to use the Linux extensions in(1,8) applications, you should use the easier-
       to-use interfaces capsetp(3) and capgetp(3).

   Current details
       Now  that  you  have  been  warned,  some  current kernel details.  The
       structs are defined as follows.

           #define _LINUX_CAPABILITY_VERSION  0x19980330

           typedef struct __user_cap_header_struct {
                   int version(1,3,5);
                   int pid;
           } *cap_user_header_t;

           typedef struct __user_cap_data_struct {
                   int effective;
                   int permitted;
                   int inheritable;
           } *cap_user_data_t;

       The calls will return EINVAL, and set(7,n,1 builtins)  the  version(1,3,5)  field  of  hdr  to
       _LINUX_CAPABILITY_VERSION when another version(1,3,5) was specified.

       The calls refer to the capabilities of the process indicated by the pid
       field of hdr when that is nonzero, or to the current process otherwise.

       For details on the data, see capabilities(7).

RETURN VALUE
       On  success,  zero is returned.  On error(8,n), -1 is returned, and errno is
       set(7,n,1 builtins) appropriately.

ERRORS
       EFAULT Bad memory address. Neither of hdrp and datap may be NULL.

       EINVAL One of the arguments was invalid.

       EPERM  An attempt was made to add a capability to the Permitted set(7,n,1 builtins), or
              to set(7,n,1 builtins) a capability in(1,8) the Effective or Inheritable sets that is
              not in(1,8) the Permitted set.

       EPERM  The calling process attempted to  use  capset()  to  modify  the
              capabilities  of  a process other than itself, but lacked suffi-
              cient privilege; the CAP_SETPCAP capability is required.

       ESRCH  No such process.

FURTHER INFORMATION
       The portable interface to the capability querying and setting functions
       is provided by the libcap library and is available from here:
       ftp://ftp.kernel.org/pub/linux/libs/security/linux-privs

SEE ALSO
       capabilities(7)



Linux 2.6.6                       2004-06-21                         CAPGET(2)

References for this manual (incoming links)