NAME

       capng_lock - lock the current process capabilities settings

SYNOPSIS

       #include <cap-ng.h>

       int capng_lock(void);

DESCRIPTION

       capng_lock  will  take  steps to prevent children of the current process to regain full privileges if the
       uid is 0. This should be called while possessing the CAP_SETPCAP capability in the kernel. This  function
       will do the following if permitted by the kernel: Set the NOROOT option on for PR_SET_SECUREBITS, set the
       NOROOT_LOCKED   option   to   on   for  PR_SET_SECUREBITS,  set  the  PR_NO_SETUID_FIXUP  option  on  for
       PR_SET_SECUREBITS, and set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS.

RETURN VALUE

       This returns 0 on success and a negative number on failure.  -1  means  a  failure  setting  any  of  the
       PR_SET_SECUREBITS options.

SEE ALSO

       capng_apply(3), prctl(2), capabilities(7)

AUTHOR

       Steve Grubb

Red Hat                                             June 2009                                      CAPNG_LOCK(3)