Quoting Christoph Lameter (cl@linux.com):
On Tue, 24 Feb 2015, Serge Hallyn wrote:
quoted
Unless I'm misunderstanding what you are saying, apps do have surprises.
They drop capabilities, execute a file, and the result has capabilities
which the app couldn't have expected. At least if the bits have to be
in fI to become part of pP', the app has a clue.
Well yes but the surprises do not occur in the cap bits they are
manipulating or inspecting via prctl.
quoted
To be clear, I'm suggesting that the rules at exec become:
pI' = pI
Ok that is new and on its own may solve the issue?
No that's not new.
quoted
pA' = pA (pA is ambient)
Thats what this patch does
quoted
pP' = (X & fP) | (pI & (fI | pA))
Hmmm... fP is empty for the file not having caps. so
pP' = pI & pA
Right.
quoted
pE' = pP' & fE
fE? So the inherited caps are not effective? fE would be empty for a file
not having caps thus the ambient caps would not be available in the child.
Yeah we could make this
pE' = pP' & (fE | pA)
-serge