Linux repositories inspector

capng_lock(3)

Red Hat
June 2009

libcap-ng-dev

Development and header files for libcap-ng

libcap-ng

A library making programming with POSIX capabilities easier than traditional libcap

libcap-ng-devel

Header files for libcap-ng library

NAME

capng_lock - lock the current process capabilities settings

SYNOPSIS

#include <cap-ng.h>
int capng_lock(void);

DESCRIPTION

capng_lock will take steps to prevent children of the current process to regain full privileges if the uid is 0. This should be called while possessing the CAP_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel: Set the NOROOT option on for PR_SET_SECUREBITS, set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS, set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS, and set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS.

RETURN VALUE

This returns 0 on success and a negative number on failure. -1 means a failure setting any of the PR_SET_SECUREBITS options.

AUTHOR

Steve Grubb
⇧ Top