user_namespaces.7: Minor rewordings of recently added text

[thirdparty/man-pages.git] / man2 / capget.2

diff --git a/man2/capget.2 b/man2/capget.2
index 496facaeb7f005f744ea9ab48e737102b6300e86..94d38d877893bf1e6d4fe736b4d9f963cb90fbb9 100644 (file)
--- a/man2/capget.2
+++ b/man2/capget.2
@@ -12,7 +12,7 @@
 .\"     64-bit capability sets in kernel 2.6.2[45].
 .\" Modified 2009-01-26, andi kleen
 .\"
-.TH CAPGET 2 2017-09-15 "Linux" "Linux Programmer's Manual"
+.TH CAPGET 2 2019-03-06 "Linux" "Linux Programmer's Manual"
 .SH NAME
 capget, capset \- set/get capabilities of thread(s)
 .SH SYNOPSIS
@@ -22,17 +22,6 @@ capget, capset \- set/get capabilities of thread(s)
 .PP
 .BI "int capset(cap_user_header_t " hdrp ", const cap_user_data_t " datap );
 .SH DESCRIPTION
-Since Linux 2.2,
-the power of the superuser (root) has been partitioned into
-a set of discrete capabilities.
-Each thread has a set of effective capabilities identifying
-which capabilities (if any) it may currently exercise.
-Each thread also has a set of inheritable capabilities that may be
-passed through an
-.BR execve (2)
-call, and a set of permitted capabilities
-that it can make effective or inheritable.
-.PP
 These two system calls are the raw kernel interface for getting and
 setting thread capabilities.
 Not only are these system calls specific to Linux,
@@ -47,11 +36,7 @@ The portable interfaces are
 and
 .BR cap_get_proc (3);
 if possible, you should use those interfaces in applications.
-If you wish to use the Linux extensions in applications, you should
-use the easier-to-use interfaces
-.BR capsetp (3)
-and
-.BR capgetp (3).
+.\"
 .SS Current details
 Now that you have been warned, some current kernel details.
 The structures are defined as follows.
@@ -129,9 +114,14 @@ calls, one can probe the capabilities of any process by specifying its
 process ID with the
 .I hdrp->pid
 field value.
+.PP
+For details on the data, see
+.BR capabilities (7).
+.\"
 .SS With VFS capabilities support
-VFS capabilities support creates a file-attribute method for attaching
-capabilities to executables.
+VFS capabilities employ a file extended attribute (see
+.BR xattr (7))
+to allow capabilities to be attached to executables.
 This privilege model obsoletes kernel support for one process
 asynchronously setting the capabilities of another.
 That is, on kernels that have VFS capabilities support, when calling
@@ -171,9 +161,6 @@ caller and
 .BR init (1);
 or a value less than \-1, in which case the change is applied
 to all members of the process group whose ID is \-\fIpid\fP.
-.PP
-For details on the data, see
-.BR capabilities (7).
 .SH RETURN VALUE
 On success, zero is returned.
 On error, \-1 is returned, and