CAPNG\_LOCK(3) Libcap-ng API CAPNG\_LOCK(3)

# [NAME](#NAME)

capng\_lock - lock the current process capabilities settings

# [SYNOPSIS](#SYNOPSIS)

**#include <cap-ng.h>**

int capng\_lock(void);

# [DESCRIPTION](#DESCRIPTION)

capng\_lock will take steps to prevent children of the current process to regain full privileges if the uid is 0. This should be called while possessing the CAP\_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel:

•

Set the NOROOT option on for PR\_SET\_SECUREBITS.

•

Set the NOROOT\_LOCKED option to on for PR\_SET\_SECUREBITS.

•

Set the PR\_NO\_SETUID\_FIXUP option on for PR\_SET\_SECUREBITS.

•

Set the PR\_NO\_SETUID\_FIXUP\_LOCKED option on for PR\_SET\_SECUREBITS.

It does not enable PR\_SET\_KEEPCAPS or the KEEP\_CAPS/KEEP\_CAPS\_LOCKED securebits. Existing securebits set by the caller are preserved, including securebits that were added after this version of libcap-ng was built.

# [RETURN VALUE](#RETURN_VALUE)

This returns 0 on success and a negative number on failure. -1 means a failure reading or updating the securebits. -2 means failure setting PR\_SET\_NO\_NEW\_PRIVS. These are additive meaning -3 is a failure of both.

# [SEE ALSO](#SEE_ALSO)

[**capng\_apply**(3)](/man/os/libcap-ng/capng_apply.3), [**prctl**(2)](/man/os/libcap-ng/prctl.2), [**capabilities**(7)](/man/os/libcap-ng/capabilities.7)

# [AUTHOR](#AUTHOR)

Steve Grubb

Mar 2026 Red Hat

---

Document: capng_lock(3) from libcap-ng 0.9.6-r1 (Chainguard OS)
Source: https://github.com/stevegrubb/libcap-ng.git