Re: [PATCH 3/3] man/man7/capabilities.7: CAP_MAC_ADMIN allows setting undefined SELinux contexts

[Alejandro Colomar <alx@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1263 bytes --]

> Date: 2026-09-12 05:32:13-0600
> From: Max Chernoff <git@maxchernoff.ca>
>
> Link: <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=12b29f34558b9b45a2c6eabd4f3c6be939a3980f>
> Signed-off-by: Max Chernoff <git@maxchernoff.ca>
> ---

Reviewed-by: Alejandro Colomar <alx@kernel.org>


Cheers,
Alex

>  man/man7/capabilities.7 | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/man/man7/capabilities.7 b/man/man7/capabilities.7
> index bb8f6d9db433..8813ff81f0ea 100644
> --- a/man/man7/capabilities.7
> +++ b/man/man7/capabilities.7
> @@ -210,8 +210,16 @@
>  .BR FS_IOC_SETFLAGS (2const)).
>  .TP
>  .BR CAP_MAC_ADMIN " (since Linux 2.6.25)"
> -Allow MAC configuration or state changes.
> -Implemented for the Smack Linux Security Module (LSM).
> +.RS
> +.IP \[bu] 3
> +.PD 0
> +For the Smack Linux Security Module (LSM),
> +allow MAC configuration or state changes;
> +.IP \[bu]
> +For the SELinux LSM,
> +allow setting undefined security contexts on inodes (since Linux 2.6.27).
> +.RE
> +.PD
>  .TP
>  .BR CAP_MAC_OVERRIDE " (since Linux 2.6.25)"
>  Override Mandatory Access Control (MAC).
> -- 
> 2.55.0
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]