Re: [PATCH 12/15] Manual pages: cap_get_file.3: NOTES: note the effect of the Ambient set
From: "Andrew G. Morgan" <morgan@kernel.org>
Date: 2020-07-20 15:36:25
I've applied all but this one. This one seems to imply that if the effective bit is lowered, but the permitted bits are raised, the ambient will have some sort of effect. This isn't how it works. Any file caps (even an empty set) suppresses any effect of the ambient vector. Cheers Andrew On Mon, Jul 20, 2020 at 2:14 AM Michael Kerrisk (man-pages) [off-list ref] wrote:
quoted hunk ↗ jump to hunk
The addition of Ambient capabilities in Linux 4.3 rendered the text on the effect of the Effective bit during execve(2) out-of-date. Fix that. Also add a couple of paragraph breaks to improve readability. Signed-off-by: Michael Kerrisk (man-pages) <redacted> --- doc/cap_get_file.3 | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)diff --git a/doc/cap_get_file.3 b/doc/cap_get_file.3 index ceacbaf..dc7b571 100644 --- a/doc/cap_get_file.3 +++ b/doc/cap_get_file.3@@ -103,13 +103,18 @@ or These functions are specified by withdrawn POSIX.1e draft specification. .SH NOTES Support for file capabilities is provided on Linux since version 2.6.24. - +.PP On Linux, the file Effective set is a single bit. If it is enabled, then all Permitted capabilities are enabled in the Effective set of the calling process when the file is executed; -otherwise, no capabilities are enabled in the process's Effective set +otherwise, the process's Ambient capabilities +(or, before the Linux 4.3 addition of Ambient capabilities, no capabilities) +are enabled in the process's Effective set following an -.BR execve (2). +.BR execve (2) +(see +.BR capabilities (7)). +.PP Because the file Effective set is a single bit, if any capability is enabled in the Effective set of the .I cap_t --2.26.2