Re: [PATCH v2] security: commoncap: clarify CAP_FS_SET comment in cap_task_fix_setuid()
From: "Serge E. Hallyn" <serge@hallyn.com>
Date: 2026-09-22 17:03:01
On Sun, Sep 20, 2026 at 11:52:08PM -0300, Adriano Cordova wrote:
CAP_FS_SET is exactly the set of capabilities that an fsuid of 0 historically granted (see CAP_FS_MASK in include/linux/capability.h), so cap_task_fix_setuid() drops that set from the effective set when fsuid leaves 0. Replace the stale FIXME with this explanation. Signed-off-by: Adriano Cordova <redacted>
lgtm, thanks. Reviewed-by: Serge Hallyn <serge@hallyn.com> If I don't see objections soon, I can merge it into the caps-next tree. thanks, -serge
quoted hunk ↗ jump to hunk
--- v2: reword the comment to something more concise. security/commoncap.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)diff --git a/security/commoncap.c b/security/commoncap.c index 3399535808fe..1ba2ea2651fc 100644 --- a/security/commoncap.c +++ b/security/commoncap.c@@ -1169,11 +1169,13 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags) break; case LSM_SETID_FS: - /* juggle the capabilities to follow FSUID changes, unless - * otherwise suppressed + /* Juggle the capabilities to follow FSUID changes, unless + * otherwise suppressed. * - * FIXME - is fsuser used for all CAP_FS_MASK capabilities? - * if not, we might be a bit too harsh here. + * CAP_FS_SET is exactly the set of capabilities that an + * fsuid of 0 historically granted (see CAP_FS_MASK in + * <linux/capability.h>), so we drop that set when fsuid + * leaves 0. */ if (!issecure(SECURE_NO_SETUID_FIXUP)) { kuid_t root_uid = make_kuid(old->user_ns, 0);-- 2.51.0