$Id: _setfilecap.2,v 1.1.1.1 1999/04/17 22:16:31 morgan Exp $
written by Andrew Main <zefram@dcs.warwick.ac.uk>

_setfilecap, _getfilecap, _fsetfilecap, _fgetfilecap - set/get file capabilities #include <sys/capability.h> "int _setfilecap(char const *" filename ", size_t " usize ", __cap_s const *" iset ", __cap_s const *" pset ", __cap_s const *" eset ); "int _getproccap(char const *" filename ", size_t " usize ", __cap_s *" iset ", __cap_s *" pset ", __cap_s *" eset ); "int _fsetfilecap(int " fd ", size_t " usize ", __cap_s const *" iset ", __cap_s const *" pset ", __cap_s const *" eset ); "int _fgetproccap(int " fd ", size_t " usize ", __cap_s *" iset ", __cap_s *" pset ", __cap_s *" eset );

cc ... -lcap

_setfilecap sets the specified filename 's Inheritable, Permitted and Effective capabilities to the sets specified. A NULL pointer specifies that a set should not be changed.

_fsetfilecap does the same thing to the file referenced by file descriptor fd .

_getfilecap and _fgetfilecap copy the file's capability sets into the sets provided. A NULL pointer specifies that a set should not be returned.

The usize argument specifies the size of the user-space capability sets, in bytes. If the kernel uses a different size internally, it will truncate or zero-fill as required.

Files don't actually have a proper Effective capability set. Instead they have a single-bit flag, that indicates that the set is either full or empty. When setting a file's capabilities, that flag will be set if and only if the Effective set specified has at least one bit set.

On success, zero is returned. On error, -1 is returned, and errno is set appropriately.

EFAULT One of the capability arguments or the filename was an invalid data pointer.

EPERM An attempt was made to set non-empty capabilities on a file, and the caller does not have the CAP_FSETCAP capability raised.

EPERM An attempt was made to set capabilities on a file, and the effective UID does not match the owner of the file, and the caller does not have the CAP_FOWNER capability raised.

EINVAL An attempt was made to set non-empty capabilities on a file residing on a file system that does not support them.

EROFS An attempt was made to set capabilities on a file residing on a read-only file system.

ENAMETOOLONG filename is too long.

ENOENT The file specified does not exist.

ENOMEM Insufficient kernel memory was available.

ENOTDIR A component of the path prefix is not a directory.

EACCES Search permission is denied on a component of the path prefix.

ELOOP filename containes a circular reference (via symlinks).

EBADF fd is not a valid file descriptor.

EIO A hard error occurred while reading or writing the file system.

ENOSYS The POSIX.1e capability system was not configured into the kernel.

These system calls are specific to Linux. The portable interfaces are cap_set_file (3), cap_get_file (3), cap_set_fd (3), and cap_get_fd (3). _setproccap (2).