| Nick Kralevich | 1d1011a | 2012-09-06 10:14:03 -0700 | [diff] [blame] | 1 | .TH "CAPNG_LOCK" "3" "June 2009" "Red Hat" "Libcap-ng API" |
| 2 | .SH NAME |
| 3 | capng_lock \- lock the current process capabilities settings |
| 4 | .SH "SYNOPSIS" |
| 5 | .B #include <cap-ng.h> |
| 6 | .sp |
| 7 | int capng_lock(void); |
| 8 | |
| 9 | .SH "DESCRIPTION" |
| 10 | |
| 11 | capng_lock will take steps to prevent children of the current process to regain full privileges if the uid is 0. This should be called while possessing the CAP_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel: Set the NOROOT option on for PR_SET_SECUREBITS, set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS, set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS, and set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS. |
| 12 | |
| 13 | |
| 14 | .SH "RETURN VALUE" |
| 15 | |
| 16 | This returns 0 on success and a negative number on failure. -1 means a failure setting any of the PR_SET_SECUREBITS options. |
| 17 | |
| 18 | .SH "SEE ALSO" |
| 19 | |
| 20 | .BR capng_apply (3), |
| 21 | .BR prctl (2), |
| 22 | .BR capabilities (7) |
| 23 | |
| 24 | .SH AUTHOR |
| 25 | Steve Grubb |