We've seen how to build a capability-dumb binary; now let's figure out how to add or drop process (thread) capabilities at runtime within the program itself.
The other side of the coin from getcap is the setcap of course—we have already worked with the utility on the command line. Now lets work with the relevant APIs.
The thing to understand is this: To work with the process capsets, we require what is called a "capability state" in memory. To get this capability state, we use the cap_get_proc(3) API (of course, as mentioned earlier, all these APIs are from the libcap library, which we will link into). Once we have a working context, the capability state, we will use the cap_set_flag(3) API to set up ...
