.\" written by Andrew Morgan <morgan@kernel.org>
+.\"
+.\" %%%LICENSE_START(GPL_NOVERSION_ONELINE)
.\" may be distributed as per GPL
+.\" %%%LICENSE_END
+.\"
.\" Modified by David A. Wheeler <dwheeler@ida.org>
.\" Modified 2004-05-27, mtk
.\" Modified 2004-06-21, aeb
.\" 64-bit capability sets in kernel 2.6.2[45].
.\" Modified 2009-01-26, andi kleen
.\"
-.TH CAPGET 2 2010-09-20 "Linux" "Linux Programmer's Manual"
+.TH CAPGET 2 2013-03-11 "Linux" "Linux Programmer's Manual"
.SH NAME
capget, capset \- set/get capabilities of thread(s)
.SH SYNOPSIS
call, and a set of permitted capabilities
that it can make effective or inheritable.
.PP
-These two functions are the raw kernel interface for getting and
+These two system calls are the raw kernel interface for getting and
setting thread capabilities.
Not only are these system calls specific to Linux,
but the kernel API is likely to change and use of
-these functions (in particular the format of the
+these system calls (in particular the format of the
.I cap_user_*_t
types) is subject to extension with each kernel revision,
but old programs will keep working.
.BR capsetp (3)
and
.BR capgetp (3).
-.SS "Current details"
+.SS Current details
Now that you have been warned, some current kernel details.
The structures are defined as follows.
.sp
.fi
.in -4n
.sp
-.I effective, permitted, inheritable
-are bitmasks of the capabilities defined in
+The
+.IR effective ,
+.IR permitted ,
+and
+.I inheritable
+fields are bit masks of the capabilities defined in
.I capability(7).
Note the
-.I CAP_*
+.B CAP_*
values are bit indexes and need to be bit-shifted before ORing into
the bit fields.
To define the structures for passing to the system call you have to use the
process ID with the
.I hdrp->pid
field value.
-.SS With VFS Capability Support
+.SS With VFS capability support
VFS Capability support creates a file-attribute method for adding
capabilities to privileged executables.
This privilege model obsoletes kernel support for one process
are 0 or
.BR getpid (2),
which are equivalent.
-.SS Without VFS Capability Support
+.SS Without VFS capability support
When the kernel does not support VFS capabilities,
.BR capset ()
calls can operate on the capabilities of the thread specified by the
For details on the data, see
.BR capabilities (7).
-.SH "RETURN VALUE"
+.SH RETURN VALUE
On success, zero is returned.
On error, \-1 is returned, and
.I errno
.TP
.B ESRCH
No such thread.
-.SH "CONFORMING TO"
+.SH CONFORMING TO
These system calls are Linux-specific.
.SH NOTES
The portable interface to the capability querying and setting
.I libcap
library and is available here:
.br
-http://www.kernel.org/pub/linux/libs/security/linux-privs
-.SH "SEE ALSO"
+.UR http://git.kernel.org/cgit\:/linux\:/kernel\:/git\:/morgan\:\:/libcap.git
+.UE
+.SH SEE ALSO
.BR clone (2),
.BR gettid (2),
.BR capabilities (7)