Re: [PATCH v4 1/2] capabilities: Ambient capabilities

On Wed, Jul 15, 2015 at 4:13 AM, James Morris [off-list ref] wrote:

On Tue, 14 Jul 2015, Andy Lutomirski wrote:

quoted

===== The proposed change =====

This patch adds a fifth capability mask called the ambient mask
(pA).  pA does what most people expect pI to do.

This looks good, and I think it will lead to better overall security
because people will find capabilities easier to use for real-world
scenarios.

Has it had enough security review?  This is a significant new behavior
being added to a widely enabled security module.

I've reviewed it, as have Kees and Serge.  Of course, I wrote it, so
my review should be taken with many grains of salt.

I'll review it again between now and 4.3.  All of my security thought
cycles are currently taken up by a really nasty bug that dwarfs and
problems this code could possibly introduce :)

--Andy

- James
--
James Morris
[off-list ref]

-- 
Andy Lutomirski
AMA Capital Management, LLC