As far as I understand, we cannot set ctty from our callback context before fork-exec, so we would likely need to fork kernel.org/pub/linux/libs/security/libcap/cap (GPL-2.0-only or BSD licensed) to implement ctty by modifying SysProcAttr. Apparently we use this feature to set controlling TTY for dashboard process.

Nvm, apparently *pa is given in the callback. Let me try that tomorrow. Also, do we have tests for dropping capabilities? I believe I should create one, just to be sure and test my changes.

cat /proc/1324/status | grep Cap and /sbin/capsh --decode=000001f3fdfeffff can be used to get and decode capability sets, respectively, so using API to get processes and then get their caps from sysfs should work just fine.