debian man page for capng_lock

CAPNG_LOCK(3)							   Libcap-ng API						     CAPNG_LOCK(3)

NAME
       capng_lock - lock the current process capabilities settings

SYNOPSIS
       #include <cap-ng.h>

       int capng_lock(void);

DESCRIPTION
       capng_lock  will  take  steps  to  prevent children of the current process to regain full privileges if the uid is 0. This should be called
       while possessing the CAP_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel: Set  the  NOROOT
       option  on  for	PR_SET_SECUREBITS,  set  the  NOROOT_LOCKED  option  to on for PR_SET_SECUREBITS, set the PR_NO_SETUID_FIXUP option on for
       PR_SET_SECUREBITS, and set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS.

RETURN VALUE
       This returns 0 on success and a negative number on failure. -1 means a failure setting any of the PR_SET_SECUREBITS options.

SEE ALSO
       capng_apply(3), prctl(2), capabilities(7)

AUTHOR
       Steve Grubb

Red Hat 							     June 2009							     CAPNG_LOCK(3)