Re: [PATCH] properly split capset_check+capset_set

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

On Maw, 2005-01-04 at 16:27, Serge E. Hallyn wrote:
> The attached patch removes checks from kernel/capability.c which are
> redundant with cap_capset_check() code, and moves the capset_check()
> calls to immediately before the capset_set() calls.  This allows
> capset_check() to accurately check the setter's permission to set caps
> on the target.  Please apply.

Why does this help ?

A partial failure now returns no error ?


);
> +		while_each_thread(g, target) {
> +			if (!security_capset_check(target, effective,
> +							inheritable,
> +							permitted)) {
> +				security_capset_set(target, effective,
> +							inheritable,
> +							permitted);
> +				ret = 0;
> +			}
> +			found = 1;