CAPNG_LOCK(3)                    Libcap-ng API                   CAPNG_LOCK(3)

NAME
       capng_lock - lock the current process capabilities settings

SYNOPSIS
       #include <cap-ng.h>

       int capng_lock(void);


DESCRIPTION
       capng_lock will take steps to prevent children of the current process
       to regain full privileges if the uid is 0. This should be called while
       possessing the CAP_SETPCAP capability in the kernel. This function will
       do the following if permitted by the kernel:

       o Set the NOROOT option on for PR_SET_SECUREBITS.

       o Set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS.

       o Set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS.

       o Set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS.

       It does not enable PR_SET_KEEPCAPS or the KEEP_CAPS/KEEP_CAPS_LOCKED
       securebits. Existing securebits set by the caller are preserved,
       including securebits that were added after this version of libcap-ng
       was built.



RETURN VALUE
       This returns 0 on success and a negative number on failure. -1 means a
       failure reading or updating the securebits. -2 means failure setting
       PR_SET_NO_NEW_PRIVS. These are additive meaning -3 is a failure of
       both.


SEE ALSO
       capng_apply(3), prctl(2), capabilities(7)


AUTHOR
       Steve Grubb

Red Hat                            Mar 2026                      CAPNG_LOCK(3)