[PATCH v2] security: commoncap: clarify CAP_FS_SET comment in cap_task_fix_setuid()
From: Adriano Cordova <hidden>
Date: 2026-09-21 02:52:20
Subsystem:
capabilities, security subsystem, the rest · Maintainers:
Serge Hallyn, Paul Moore, James Morris, Linus Torvalds
CAP_FS_SET is exactly the set of capabilities that an fsuid of 0 historically granted (see CAP_FS_MASK in include/linux/capability.h), so cap_task_fix_setuid() drops that set from the effective set when fsuid leaves 0. Replace the stale FIXME with this explanation. Signed-off-by: Adriano Cordova <redacted> --- v2: reword the comment to something more concise. security/commoncap.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/security/commoncap.c b/security/commoncap.c
index 3399535808fe..1ba2ea2651fc 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c@@ -1169,11 +1169,13 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags) break; case LSM_SETID_FS: - /* juggle the capabilities to follow FSUID changes, unless - * otherwise suppressed + /* Juggle the capabilities to follow FSUID changes, unless + * otherwise suppressed. * - * FIXME - is fsuser used for all CAP_FS_MASK capabilities? - * if not, we might be a bit too harsh here. + * CAP_FS_SET is exactly the set of capabilities that an + * fsuid of 0 historically granted (see CAP_FS_MASK in + * <linux/capability.h>), so we drop that set when fsuid + * leaves 0. */ if (!issecure(SECURE_NO_SETUID_FIXUP)) { kuid_t root_uid = make_kuid(old->user_ns, 0);
--
2.51.0