Re: [PATCH] capabilities: Ambient capability set V1

Quoting Christoph Lameter (cl@linux.com):

On Tue, 24 Feb 2015, Serge Hallyn wrote:

quoted

Unless I'm misunderstanding what you are saying, apps do have surprises.
They drop capabilities, execute a file, and the result has capabilities
which the app couldn't have expected.  At least if the bits have to be
in fI to become part of pP', the app has a clue.

Well yes but the surprises do not occur in the cap bits they are
manipulating or inspecting via prctl.

quoted

To be clear, I'm suggesting that the rules at exec become:

pI' = pI

Ok that is new and on its own may solve the issue?

No that's not new.

quoted

pA' = pA  (pA is ambient)

Thats what this patch does

quoted

pP' = (X & fP) | (pI & (fI | pA))

Hmmm... fP is empty for the file not having caps. so

pP' = pI & pA

Right.

quoted

pE' = pP' & fE

fE? So the inherited caps are not effective? fE would be empty for a file
not having caps thus the ambient caps would not be available in the child.

Yeah we could make this

pE' = pP' & (fE | pA)

-serge