[PATCH v3] security: commoncap: drop stale CAP_FS_MASK FIXME

[PATCH v3] security: commoncap: drop stale CAP_FS_MASK FIXME

[Adriano Cordova]

CAP_FS_SET is exactly the set of capabilities that an fsuid of 0
historically granted (see CAP_FS_MASK in include/linux/capability.h),
so cap_task_fix_setuid() drops that set from the effective set when
fsuid leaves 0.  Remove the stale FIXME.

Signed-off-by: Adriano Cordova <adrianox@gmail.com>
---
v3: just drop the FIXME instead of replacing it with another explanation.

 security/commoncap.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/security/commoncap.c b/security/commoncap.c
index 3399535808fe..484d2b9256e9 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -1171,9 +1171,6 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
 	case LSM_SETID_FS:
 		/* juggle the capabilities to follow FSUID changes, unless
 		 * otherwise suppressed
-		 *
-		 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
-		 *          if not, we might be a bit too harsh here.
 		 */
 		if (!issecure(SECURE_NO_SETUID_FIXUP)) {
 			kuid_t root_uid = make_kuid(old->user_ns, 0);
-- 
2.51.0

Re: [PATCH v3] security: commoncap: drop stale CAP_FS_MASK FIXME

[sashiko-bot]

> CAP_FS_SET is exactly the set of capabilities that an fsuid of 0
> historically granted (see CAP_FS_MASK in include/linux/capability.h),
> so cap_task_fix_setuid() drops that set from the effective set when
> fsuid leaves 0.  Remove the stale FIXME.
> 
> Signed-off-by: Adriano Cordova <adrianox@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026131010.1822069-1-adrianox@gmail.com?part=1