---
name: "capng_lock"
section: "3"
platform: "linux"
package: "libcap-ng"
version: "0.9.6-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/capng_lock"
---

# capng\_lock(3)

lock the current process capabilities settings

## NAME

capng\_lock - lock the current process capabilities settings

## SYNOPSIS

**#include \<cap-ng.h\>**

int capng\_lock(void);

## DESCRIPTION

capng\_lock will take steps to prevent children of the current process to regain full privileges if the uid is 0. This should be called while possessing the CAP\_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel:

- •

  Set the NOROOT option on for PR\_SET\_SECUREBITS.

- •

  Set the NOROOT\_LOCKED option to on for PR\_SET\_SECUREBITS.

- •

  Set the PR\_NO\_SETUID\_FIXUP option on for PR\_SET\_SECUREBITS.

- •

  Set the PR\_NO\_SETUID\_FIXUP\_LOCKED option on for PR\_SET\_SECUREBITS.

It does not enable PR\_SET\_KEEPCAPS or the KEEP\_CAPS/KEEP\_CAPS\_LOCKED securebits. Existing securebits set by the caller are preserved, including securebits that were added after this version of libcap-ng was built.

## RETURN VALUE

This returns 0 on success and a negative number on failure. -1 means a failure reading or updating the securebits. -2 means failure setting PR\_SET\_NO\_NEW\_PRIVS. These are additive meaning -3 is a failure of both.

## SEE ALSO

[**capng\_apply**(3)](/capng_apply/3.md), [**prctl**(2)](/prctl/2.md), [**capabilities**(7)](/capabilities/7.md)

## AUTHOR

Steve Grubb