---
name: "__audit_log_bprm_fcaps"
section: "9"
platform: "linux"
package: "linux-manual-4.9"
version: "4.9.228-1"
release: "Debian 9 (Stretch)"
platforms: ["linux"]
url: "https://new.carta.tech/__audit_log_bprm_fcaps"
---

# \_\_audit\_log\_bprm\_fcaps(9)

store information about a loading bprm and relevant fcaps

## NAME

\_\_audit\_log\_bprm\_fcaps - store information about a loading bprm and relevant fcaps

## SYNOPSIS

**int \_\_audit\_log\_bprm\_fcaps(struct linux\_binprm \*** *bprm***, const struct cred \*** *new***, const struct cred \*** *old***);**

## ARGUMENTS

*bprm*

pointer to the bprm being processed

*new*

the proposed new credentials

*old*

the old credentials

## DESCRIPTION

Simply check if the proc already has the caps given by the file and if not store the priv escalation info for later auditing at the end of the syscall

\-Eric

## COPYRIGHT