# Re: \[PATCH v2 1/2\] capabilities: Ambient capabilities

- From: Christoph Lameter \<hidden\>
- Date: 2015-05-26 16:23:18 
- List: linux-api
- Page: https://ratatoskr.run/linux-api/2015/05/4502393
- Thread: https://ratatoskr.run/linux-api/2015/05/4494133/t.md

```text
On Sat, 23 May 2015, Serge Hallyn wrote:

> > You cannot use pA to try to subvert a setuid, setgid, or file-capped
> > program: if you execute any such program, pA gets cleared and the
> > resulting evolution rules are unchanged by this patch.
>
> Christoph, just to be sure, is this ^ going to suffice for you?
>
> Seems like it should since any program which is setuid-root, i.e.
> passwd, isn't likely to be designed to exec other programs.

Yes that should work.
```