Messages in this thread | | | Date | Fri, 5 Oct 2012 01:42:18 +0400 | Subject | Re: [PATCH] proc: don't show nonexistent capabilities | From | Andrey Wagin <> |
| |
2012/10/3 Serge E. Hallyn <serge@hallyn.com>: > Quoting Andrew Vagin (avagin@openvz.org): >> Without this patch it is really hard to interpret a bounding set, >> if CAP_LAST_CAP is unknown for a current kernel. >> >> Non-existant capabilities can not be deleted from a bounding set >> with help of prctl. >> >> E.g.: Here are two examples without/with this patch. >> CapBnd: ffffffe0fdecffff >> CapBnd: 00000000fdecffff >> >> I suggest to hide non-existent capabilities. Here is two reasons. >> * It's logically and easier for using. >> * It helps to checkpoint-restore capabilities of tasks, because tasks >> can be restored on another kernel, where CAP_LAST_CAP is bigger. >> >> Cc: Serge Hallyn <serge.hallyn@canonical.com> > > Hm, I don't object to this patch. Sounds useful indeed. I can't > help shake the feeling though that something somewhere will get > confused by this (though it shouldn't), so I'd like to do some > testing. Have you run ltp against this? Are you running this > daily with your distro?
I've been using a kernel with this patch on my workstation (FC17) for two days. The same kernel works on a test server (RHEL6).
I've executed LTP on the kernel with this patch and without it and the results are not differ. The results for both kernels are attached.
Thanks.
> >> Cc: Pavel Emelyanov <xemul@parallels.com> >> Signed-off-by: Andrew Vagin <avagin@openvz.org> >> --- >> include/linux/capability.h | 3 ++- >> 1 files changed, 2 insertions(+), 1 deletions(-) >> >> diff --git a/include/linux/capability.h b/include/linux/capability.h >> index d10b7ed..1642778 100644 >> --- a/include/linux/capability.h >> +++ b/include/linux/capability.h >> @@ -420,7 +420,8 @@ extern const kernel_cap_t __cap_init_eff_set; >> #else /* HAND-CODED capability initializers */ >> >> # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }}) >> -# define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }}) >> +# define CAP_FULL_SET ((kernel_cap_t){{ ~0, \ >> + CAP_TO_MASK(CAP_LAST_CAP + 1) - 1 } }) >> # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \ >> | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \ >> CAP_FS_MASK_B1 } }) >> -- >> 1.7.1 >> >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in >> the body of a message to majordomo@vger.kernel.org >> More majordomo info at http://vger.kernel.org/majordomo-info.html >> Please read the FAQ at http://www.tux.org/lkml/ [unhandled content-type:application/x-gzip][unhandled content-type:application/x-gzip] | |