Man page 9 : __audit_log_bprm_fcaps

__audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps

int __audit_log_bprm_fcaps(struct linux_binprm *  bprm , const struct cred *  new , const struct cred *  old );

bprm
    pointer to the bprm being processed

new
    the proposed new credentials

old
    the old credentials

Simply check if the proc already has the caps given by the file and if not store the priv escalation info for later auditing at the end of the syscall

-Eric