capget

Implemented in Antinomie 0.7.0 · Syscall list

Synopsis

long capget(cap_user_header_t header, cap_user_data_t dataptr);

Number (x86-64)	125
ABI	common
Kernel entry point	sys_capget

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Reads the capability sets of a process.

Arguments

Name	Type	Meaning
header (arg0)	cap_user_header_t	Pointer to a capability header.
dataptr (arg1)	cap_user_data_t	Pointer to a mapped data structure.

Return value

On success: 0.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-14	EFAULT	A pointer argument points outside the accessible address space.
-22	EINVAL	An argument is invalid.
-3	ESRCH	No such process or thread.

Man page

capget(2) on man7.org

Captured by Antinomie

Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
header (arg0)	Entry	the pointer itself, as a raw word	args.0, args.raw[0]
↳ pointee	Entry	u32 header version	arg0.version	always
↳ pointee	Entry	pid_t target	arg0.pid	the version is known and the data pointer is not NULL
dataptr (arg1)	Entry	the pointer itself, as a raw word	args.1, args.raw[1]
↳ pointee	Exit	array of cap_data (1 or 2 entries by version)	arg1.capabilities	result is 0 and the pointer is not NULL

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.header (arg0), args.dataptr (arg1); args.0 to args.5 by position.
• Structure u32 behind header (arg0): args.header.<member> for value.
• Structure cap_data[] behind dataptr (arg1): args.dataptr.<member> for effective, inheritable, permitted.

See Syscall Trace filter for the full syntax.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.