NAME

       cap_clear, cap_clear_flag, cap_get_flag, cap_set_flag, cap_compare - capability data object manipulation

SYNOPSIS

       #include <sys/capability.h>

       int cap_clear(cap_t cap_p);

       int cap_clear_flag(cap_t cap_p, cap_flag_t flag);

       int cap_get_flag(cap_t cap_p, cap_value_t cap,
                        cap_flag_t flag, cap_flag_value_t *value_p);

       int cap_set_flag(cap_t cap_p, cap_flag_t flag, int ncap,
                        const cap_value_t *caps, cap_flag_value_t value);

       int cap_compare(cap_t cap_a, cap_t cap_b);

       Link with -lcap.

DESCRIPTION

       These  functions work on a capability state held in working storage.  A cap_t holds information about the
       capabilities in each of the three sets, Permitted, Inheritable, and Effective.  Each capability in a  set
       may be clear (disabled, 0) or set (enabled, 1).

       These functions work with the following data types:

       cap_value_t       identifies a capability, such as CAP_CHOWN.

       cap_flag_t        identifies one of the three flags associated with a capability (i.e., it identifies one
                         of the  three  capability  sets).   Valid  values  for  this  type  are  CAP_EFFECTIVE,
                         CAP_INHERITABLE or CAP_PERMITTED.

       cap_flag_value_t  identifies  the setting of a particular capability flag (i.e, the value of a capability
                         in a set).  Valid values for this type are CAP_CLEAR (0) or CAP_SET (1).

       cap_clear() initializes the capability  state  in  working  storage  identified  by  cap_p  so  that  all
       capability flags are cleared.

       cap_clear_flag() clears all of the capabilities of the specified capability flag, flag.

       cap_get_flag()  obtains  the current value of the capability flag, flag, of the capability, cap, from the
       capability state identified by cap_p and places it in the location pointed to by value_p.

       cap_set_flag() sets the flag, flag, of each  capability  in  the  array  caps  in  the  capability  state
       identified  by  cap_p to value.  The argument, ncap, is used to specify the number of capabilities in the
       array, caps.

       cap_compare() compares two full capability sets and, in the spirit of memcmp(), returns zero if  the  two
       capability  sets  are identical. A positive return value, status, indicates there is a difference between
       them. The returned value carries further information about which of three sets, cap_flag_t flag,  differ.
       Specifically,  the  macro CAP_DIFFERS (status, flag) evaluates to non-zero if the returned status differs
       in its flag components.

RETURN VALUE

       cap_clear(), cap_clear_flag(), cap_get_flag() cap_set_flag() and cap_compare() return  zero  on  success,
       and -1 on failure. Other return values for cap_compare() are described above.

       On failure, errno is set to EINVAL, indicating that one of the arguments is invalid.

CONFORMING TO

       These   functions   are  as  per  the  withdrawn  POSIX.1e  draft  specification.   cap_clear_flag()  and
       cap_compare() are Linux extensions.

SEE ALSO

       libcap(3),   cap_copy_ext(3),   cap_from_text(3),    cap_get_file(3),    cap_get_proc(3),    cap_init(3),
       capabilities(7)

                                                   2008-05-11                                       CAP_CLEAR(3)