MAN page from Trustix libcap-devel-1.10-5tr.i586.rpm

CAP_GET_PROC

Section: Linux Programmer's Manual (3)
Updated: 26th May 1997
Index

NAME

cap_get_proc, cap_set_proc - POSIX capability manipulation onprocesses

capgetp, capsetp - Linux specific capability manipulation onarbitrary processes

SYNOPSIS

#include <sys/capability.h>

cap_t cap_get_proc(void);
int cap_set_proc(cap_t cap_p);

#undef _POSIX_SOURCE
#include <sys/capability.h>

cap_t capgetp(pid_t pid, cap_t cap_d);
cap_t capsetp(pid_t pid, cap_t cap_d);

USAGE

cc ... -lcap

DESCRIPTION

cap_get_procallocates a capability state in working storage, sets its state tothat of the calling process, and returns a pointer to this newlycreated capability state. The caller should free any releasablememory, when the capability state in working storage is no longerrequired, by callingcap_freewith thecap_tas an argument.

cap_set_procsets the values for all capability flags for all capabilities with thecapability state identified bycap_p.The new capability state of the process will be completely determined bythe contents ofcap_pupon successful return from this function. If any flag incap_pis set for any capability not currently permitted for the calling process,the function will fail, and the capability state of the process will remainunchanged.

capgetpfills an existingcap_d,see cap_init(3),with the process capabilities of the process indicated bypid.This information can also be obtained from the/proc/<pid>/statusfile.

capsetpattempts to set the capabilities of some other process(es),pid.Ifpidis positive it refers to a specific process; if it is zero, it refersto the current process; -1 refers to all processes other than thecurrent process and process '1' (typically init(8));other negative values refer to the-pidprocess-group. In order to use this function, the current processmust haveCAP_SETPCAPraised in its Effective capability set. The capabilities set in thetarget process(es) are those contained incap_d.

RETURN VALUE

cap_get_procreturns a non-NULL value on success, and NULL on failure.

cap_set_proc, capgetp and capsetpreturn zero for success, and -1 on failure.

On failure,errno(3)is set toEINVAL,EPERM,orENOMEM.

CONFORMING TO

cap_set_procandcap_get_procare functions specified in the draft for POSIX.1e.

NOTES

The functioncapsetpshould be used with care. It exists, primarily, to overcome a lack ofsupport for capabilities in any of the filesystems supported by Linux.The semantics of this function may change as it is better understood.Please note, by default, the only processes that haveCAP_SETPCAPavailable to them are processes started as a kernel-thread.(Typically this includesinit(8),kflushd and kswapd). You will need to recompile the kernel to modifythis default.

This document was created byman2html,using the manual pages.