Messages in this thread | | | Date | Thu, 26 Feb 2015 12:28:30 -0600 (CST) | From | Christoph Lameter <> | Subject | Re: [PATCH] capabilities: Ambient capability set V1 |
| |
On Thu, 26 Feb 2015, Serge E. Hallyn wrote:
> > Well doing that breaks su. > > Don't what exactly? You're saying that doing > > pI' = pI > pA' = pA (pA is ambient) > pP' = (X & fP) | (pI & (fI | pA)) > pE' = pP' & (fE | pA) > > stopped su from having CAP_SETGID while > > pI' = pI > pA' = pA (pA is ambient) > pP' = (X & fP) | (pI & (fI | pA)) > pE' = pP' & fE > > worked? I'll hope you're saying both "fail", in which case
fE does not exist in cpu_vfs_cap_data. We only get fI and fP. Why in the world does setcap allow setting fE?
V1 does not use fE. In my newer attempt, I seemed to have worked with zeroed field that I assumed was filled in.
I will just do
pE' = pP'
Ok?
| |