SIMPLE SOLUTIONS

CAPNG_LOCK(3) - man page online | library functions

Lock the current process capabilities settings.

Chapter
June 2009
CAPNG_LOCK(3)                             Libcap-ng API                             CAPNG_LOCK(3)

NAME capng_lock - lock the current process capabilities settings
SYNOPSIS #include <cap-ng.h> int capng_lock(void);
DESCRIPTION capng_lock will take steps to prevent children of the current process to regain full priv‐ ileges if the uid is 0. This should be called while possessing the CAP_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel: Set the NOROOT option on for PR_SET_SECUREBITS, set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS, set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS, and set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS.
RETURN VALUE This returns 0 on success and a negative number on failure. -1 means a failure setting any of the PR_SET_SECUREBITS options.
SEE ALSO capng_apply(3), prctl(2), capabilities(7)
AUTHOR Steve Grubb
Red Hat June 2009 CAPNG_LOCK(3)
This manual Reference Other manuals
capng_lock(3) referred by
refer to capabilities(7) | capng_apply(3) | prctl(2)