capset

Implemented in Antinomie 0.7.0 · Syscall list

Synopsis

long capset(cap_user_header_t header, const cap_user_data_t data);

Number (x86-64)	126
ABI	common
Kernel entry point	sys_capset

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Sets the capability sets of the calling process.

Arguments

Name	Type	Meaning
header (arg0)	cap_user_header_t	Pointer to a capability header.
data (arg1)	const cap_user_data_t	Pointer to data, or a request-specific value.

Return value

On success: 0.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-14	EFAULT	A pointer argument points outside the accessible address space.
-1	EPERM	The operation is not permitted for this process.

Man page

capset(2) on man7.org

Captured by Antinomie

Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
header (arg0)	Entry	the pointer itself, as a raw word	args.0, args.raw[0]
↳ pointee	Entry	u32 header version	arg0.version	always
↳ pointee	Entry	pid_t target	arg0.pid	the version is known
data (arg1)	Entry	the pointer itself, as a raw word	args.1, args.raw[1]
↳ pointee	Entry	array of cap_data (1 or 2 entries by version)	arg1.capabilities	the version is known

Derived and lifecycle records

• When the call changes the task’s credentials, a lifecycle.creds record gives the ids (in the initial user namespace), the capability sets and the securebits after the change. Written by a base built for Antinomie 0.7.0 or later.

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.header (arg0), args.data (arg1); args.0 to args.5 by position.
• Structure u32 behind header (arg0): args.header.<member> for value.
• Structure cap_data[] behind data (arg1): args.data.<member> for effective, inheritable, permitted.

See Syscall Trace filter for the full syntax.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.