On Thu, 26 Feb 2015, Serge E. Hallyn wrote: > > Well doing that breaks su. > > Don't what exactly? You're saying that doing > > pI' = pI > pA' = pA (pA is ambient) > pP' = (X & fP) | (pI & (fI | pA)) > pE' = pP' & (fE | pA) > > stopped su from having CAP_SETGID while > > pI' = pI > pA' = pA (pA is ambient) > pP' = (X & fP) | (pI & (fI | pA)) > pE' = pP' & fE > > worked? I'll hope you're saying both "fail", in which case fE does not exist in cpu_vfs_cap_data. We only get fI and fP. Why in the world does setcap allow setting fE? V1 does not use fE. In my newer attempt, I seemed to have worked with zeroed field that I assumed was filled in. I will just do pE' = pP' Ok? -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
