On Mon, Dec 04, 2023 at 02:22:22PM -0500, Jeff Moyer wrote: > Jens Axboe <axboe@xxxxxxxxx> writes: > > > On 12/4/23 11:40 AM, Jeff Moyer wrote: > >> Finally, as Jens mentioned, I would expect dropping priviliges to, you > >> know, drop privileges. I don't think a commit message is going to be > >> enough documentation for a change like this. > > > > Only thing I can think of here is to cache the state in > > task->io_uring->something, and then ensure those are invalidated > > whenever caps change. > > I looked through the capable() code, and there is no way that I could > find to be notified of changes. Something like LSM_HOOK_INIT on 'capset', but needs to work without CONFIG_SECURITY.
