I've got my own process listening directly for audit events on the netlink interface. I'd like to drop its privileges for normal operation. However, under certain circumstances it has to enable or disable auditing, which requires CAP_AUDIT_CONTROL. I can't work out how to create a cap_t with this capability. I've tried: cap_from_text("CAP_AUDIT_CONTROL=pe") and cap_from_text("cap_audit_control=pe") and cap_from_text("30=pe") However in all cases I get EINVAL. What am I doing wrong? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490