From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: Re: [PATCH] capabilities: Ambient capability set V1 Date: Thu, 26 Feb 2015 09:35:24 -0600 Message-ID: <20150226153524.GC15182@mail.hallyn.com> References: <20150223164623.GB32181@mail.hallyn.com> <20150223181553.GE25477@ubuntumail> <20150224051928.GA14755@mail.hallyn.com> <20150224154715.GA20682@mail.hallyn.com> <20150224164429.GB29685@ubuntumail> <20150225033247.GC29685@ubuntumail> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Christoph Lameter Cc: Serge Hallyn , "Serge E. Hallyn" , Serge Hallyn , Andy Lutomirski , Aaron Jones , Ted Ts'o , linux-security-module@vger.kernel.org, akpm@linuxfoundation.org, "Andrew G. Morgan" , Mimi Zohar , Austin S Hemmelgarn , Markku Savela , Jarkko Sakkinen , linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Michael Kerrisk , Jonathan Corbet List-Id: linux-api@vger.kernel.org On Wed, Feb 25, 2015 at 02:25:19PM -0600, Christoph Lameter wrote: > On Wed, 25 Feb 2015, Serge Hallyn wrote: > > > Yeah we could make this > > Well doing that breaks su. Don't what exactly? You're saying that doing pI' = pI pA' = pA (pA is ambient) pP' = (X & fP) | (pI & (fI | pA)) pE' = pP' & (fE | pA) stopped su from having CAP_SETGID while pI' = pI pA' = pA (pA is ambient) pP' = (X & fP) | (pI & (fI | pA)) pE' = pP' & fE worked? I'll hope you're saying both "fail", in which case > Its best to leave perm bits untouched. > christoph@fujitsu-haswell:~$ su > setgid: Operation not permitted Did you initialize by running a program to fill your pI? -serge