Re: [PATCH] capabilities: Ambient capability set V2

On Fri, Mar 6, 2015 at 10:53 AM, Christoph Lameter [off-list ref] wrote:

On Fri, 6 Mar 2015, Serge E. Hallyn wrote:

quoted

Sorry, something about that patch-patch didn't make sense to me, but I
need to look more closely.  My objection was that you were able to get the
pA capabilities into pP without them being in your pI.  Your proposed
change didn't seem like it would fix that.

Just tried to fix that. Could it be that cap_inherited is never set even
for a binary that has

christoph@fujitsu-haswell:~$ getcap ambient_test

ambient_test = cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_nice+eip

I think that's right.  fI doesn't set pI.

--Andy