Re: [PATCH v2 1/2] capabilities: Ambient capabilities

On Fri, May 15, 2015 at 4:32 AM, Lukasz Pawelczyk
[off-list ref] wrote:

On czw, 2015-05-14 at 23:39 -0700, Andy Lutomirski wrote:

quoted

@@ -696,10 +729,18 @@ static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
           uid_eq(old->suid, root_uid)) &&
          (!uid_eq(new->uid, root_uid) &&
           !uid_eq(new->euid, root_uid) &&
-          !uid_eq(new->suid, root_uid)) &&
-         !issecure(SECURE_KEEP_CAPS)) {
-             cap_clear(new->cap_permitted);
-             cap_clear(new->cap_effective);
+          !uid_eq(new->suid, root_uid))) {
+             if (!issecure(SECURE_KEEP_CAPS)) {
+                     cap_clear(new->cap_permitted);
+                     cap_clear(new->cap_effective);
+             }
+
+             /*
+              * Pre-ambient programs except setresuid to nonroot followed

I think you meant "expect". This typo changes the meaning of the
sentence.

Good catch.  I'll fix that for v3.

--Andy