1prctl(2) System Calls Manual prctl(2)
2
6 prctl - operations on a process or thread
7
9 Standard C library (libc, -lc)
10
12 #include <sys/prctl.h>
13 int prctl(int option, unsigned long arg2, unsigned long arg3,
15 unsigned long arg4, unsigned long arg5);
16
18 prctl() manipulates various aspects of the behavior of the calling
19 thread or process.
20 Note that careless use of some prctl() operations can confuse the user-
22 space run-time environment, so these operations should be used with
23 care.
24 prctl() is called with a first argument describing what to do (with
26 values defined in <linux/prctl.h>), and further arguments with a sig‐
27 nificance depending on the first one. The first argument can be:
28 PR_CAP_AMBIENT (since Linux 4.3)
30 Reads or changes the ambient capability set of the calling
31 thread, according to the value of arg2, which must be one of the
32 following:
33 PR_CAP_AMBIENT_RAISE
35 The capability specified in arg3 is added to the ambient
36 set. The specified capability must already be present in
37 both the permitted and the inheritable sets of the
38 process. This operation is not permitted if the
39 SECBIT_NO_CAP_AMBIENT_RAISE securebit is set.
40 PR_CAP_AMBIENT_LOWER
42 The capability specified in arg3 is removed from the am‐
43 bient set.
44 PR_CAP_AMBIENT_IS_SET
46 The prctl() call returns 1 if the capability in arg3 is
47 in the ambient set and 0 if it is not.
48 PR_CAP_AMBIENT_CLEAR_ALL
50 All capabilities will be removed from the ambient set.
51 This operation requires setting arg3 to zero.
52 In all of the above operations, arg4 and arg5 must be specified
54 as 0.
55 Higher-level interfaces layered on top of the above operations
57 are provided in the libcap(3) library in the form of cap_get_am‐
58 bient(3), cap_set_ambient(3), and cap_reset_ambient(3).
59 PR_CAPBSET_READ (since Linux 2.6.25)
61 Return (as the function result) 1 if the capability specified in
62 arg2 is in the calling thread's capability bounding set, or 0 if
63 it is not. (The capability constants are defined in <linux/ca‐
64 pability.h>.) The capability bounding set dictates whether the
65 process can receive the capability through a file's permitted
66 capability set on a subsequent call to execve(2).
67 If the capability specified in arg2 is not valid, then the call
69 fails with the error EINVAL.
70 A higher-level interface layered on top of this operation is
72 provided in the libcap(3) library in the