capng_lock3
Lock the current process capabilities settings
Usage
#include <cap-ng.h>
int capng_lock(void);
Overview
capng_lock will take steps to prevent children of the current process to regain full privileges if the uid is 0. This should be called while possessing the CAP_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel:
•
|
Set the NOROOT option on for PR_SET_SECUREBITS. |
|---|---|
•
|
Set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS. |
•
|
Set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS. |
•
|
Set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS. |
It does not enable PR_SET_KEEPCAPS or the KEEP_CAPS/KEEP_CAPS_LOCKED securebits. Existing securebits set by the caller are preserved, including securebits that were added after this version of libcap-ng was built.
Return value
This returns 0 on success and a negative number on failure. -1 means a failure reading or updating the securebits. -2 means failure setting PR_SET_NO_NEW_PRIVS. These are additive meaning -3 is a failure of both.
Releases
9 releases since Debian 6.0 (Squeeze); the text changed 2 times.