Messages in this thread | | | Date | Sat, 7 Mar 2015 15:35:54 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH] capabilities: Ambient capability set V2 |
| |
On Sat, Mar 07, 2015 at 09:09:05AM -0600, Christoph Lameter wrote: > On Fri, 6 Mar 2015, Serge E. Hallyn wrote: > > > > I think that's right. fI doesn't set pI. > > > > Right. The idea is that for the running binary to get capability x in its > > pP, its privileged ancestor must have set x in pI, and the binary itself > > must be trusted with x in fI. > > The ancestor here is ambient_test and when it is run pI will not be set > despite the cap setting.
ambient_test is supposed to set it.
> Therefore anything is spawns cannot have the inheritance bits set either. > This plainly does not make any sense whatsoever. If this is so as it seems > to be then we should be able to remove the inheritance bits because they > have no effect. >
| |