Re: [PATCH] CRED: Fix regression in cap_capable() as shown up by sys_faccessat() [ver #2]

James Morris
2009-01-05T02:07:45Z

On Wed, 31 Dec 2008, David Howells wrote:

>
> Here's an improved patch. It differentiates the use of objective and
> subjective capabilities by making capable() only check current's subjective
> caps, but making has_capability() check only the objective caps of whatever
> process is specified.
>
> It's a bit more involved, but I think it's the right thing to do.

I think it's the right approach, too, and the patch seems ok to me. I've
applied it to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

and expect to push it to Linus in the next day or so. It's not a trivial
change, and could do with more review (Serge?).

It seems that more testing should be done in linux-next vs. waiting for
the merge window.

- James
--
James Morris
<jmorris@namei.org>