---
name: "capng_apply"
section: "3"
platform: "linux"
package: "libcap-ng"
version: "0.9.6-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/capng_apply"
---

# capng\_apply(3)

apply the stored capabilities settings

## NAME

capng\_apply - apply the stored capabilities settings

## SYNOPSIS

**#include \<cap-ng.h\>**

int capng\_apply(capng\_select\_t set);

## DESCRIPTION

capng\_apply will transfer the specified internal POSIX capabilities settings to the kernel. The options are CAPNG\_SELECT\_CAPS for the traditional capabilities, CAPNG\_SELECT\_BOUNDS for the bounding set, CAPNG\_SELECT\_BOTH if transferring both is desired, CAPNG\_SELECT\_AMBIENT if only operating on the ambient capabilities, or CAPNG\_SELECT\_ALL if applying all is desired.

## RETURN VALUE

This returns 0 on success and a negative value on failure. The values are:

- \-1 not initialized

  - \-2 CAPNG\_SELECT\_BOUNDS and failure to drop a bounding set capability

  - \-3 CAPNG\_SELECT\_BOUNDS and failure to re-read bounding set

  - \-4 CAPNG\_SELECT\_BOUNDS and process does not have CAP\_SETPCAP

  - \-5 CAPNG\_SELECT\_CAPS and failure in capset syscall

  - \-6 CAPNG\_SELECT\_AMBIENT and process has no capabilities and failed clearing ambient capabilities

  - \-7 CAPNG\_SELECT\_AMBIENT and process has capabilities and failed clearing ambient capabilities

  - \-8 CAPNG\_SELECT\_AMBIENT and process has capabilities and failed setting an ambient capability

  - \-9 Unable to acquire process capabilities to check if CAP\_SETPCAP is set.

  ## NOTES

If you are doing multi-threaded programming, calling this function will only set capabilities on the calling thread. All other threads are unaffected. If you want to set overall capabilities for a multi-threaded process, you will need to do that before creating any threads. See the capset syscall for more information on this topic.

Also, bits in the bounding set can only be dropped. You cannot set them. After dropping bounding set capabilities, the bounding set is synchronized with the kernel to reflect the true state in the kernel.

## SEE ALSO

[**capset**(2)](/capset/2.md), [**capng\_update**(3)](/capng_update/3.md), [**capabilities**(7)](/capabilities/7.md)

## AUTHOR

Steve Grubb