linux-master/kernel/auditsc.c

1456 		audit_log_format(ab, "pid=%d", context->capset.pid);
1457 		audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
1458 		audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
1459 		audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
1460 		audit_log_cap(ab, "cap_pa", &context->capset.cap.ambient);
2835  * __audit_log_capset - store information about the arguments to the capset syscall
2846 	context->capset.pid = task_tgid_nr(current);
2847 	context->capset.cap.effective   = new->cap_effective;
2848 	context->capset.cap.inheritable = new->cap_effective;
2849 	context->capset.cap.permitted   = new->cap_permitted;
2850 	context->capset.cap.ambient     = new->cap_ambient;