Man page 9 : __audit_log_capset

__audit_log_capset - store information about the arguments to the capset syscall

void __audit_log_capset(pid_t  pid , const struct cred *  new , const struct cred *  old );

pid
    target pid of the capset call

new
    the new credentials

old
    the old (current) credentials

Record the aguments userspace sent to sys_capset for later printing by the audit system if applicable