On Tue, Sep 29, 2015 at 10:47 AM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > On Mon, Sep 28, 2015 at 6:03 PM, Andy Lutomirski <luto@xxxxxxxxxx> wrote: >> Signed-off-by: Andy Lutomirski <luto@xxxxxxxxxx> >> --- >> man2/prctl.2 | 12 ++++++++++++ >> man7/capabilities.7 | 40 ++++++++++++++++++++++++++++++++++------ >> 2 files changed, 46 insertions(+), 6 deletions(-) >> >> diff --git a/man2/prctl.2 b/man2/prctl.2 >> index e743a6305969..5bcec391c110 100644 >> --- a/man2/prctl.2 >> +++ b/man2/prctl.2 >> @@ -954,6 +954,18 @@ had been called. >> For further information on Intel MPX, see the kernel source file >> .IR Documentation/x86/intel_mpx.txt . >> .\" >> +.TP >> +.BR PR_CAP_AMBIENT " (since Linux 4.2)" >> +Reads or changes the ambient capability set. If arg2 is PR_CAP_AMBIENT_RAISE, >> +then the capability specified in arg3 is added to the ambient set. This will >> +fail, returning EPERM, if the capability is not already both permitted and >> +inheritable or if the SECBIT_NO_CAP_AMBIENT_RAISE securebit is set. If arg2 >> +is PR_CAP_AMBIENT_LOWER, then the capability specified in arg3 is removed >> +from the ambient set. If arg2 is PR_CAP_AMBIENT_IS_SET, then >> +.BR prctl (2) >> +will return 1 if the capability in arg3 is in the ambient set and 0 if not. >> +If arg2 is PR_CAP_AMBIENT_CLEAR_ALL, then all capabilities will >> +be removed from the ambient set. > > In the case of CLEAR_ALL, is arg3 "don't care", or must it be set to 0? Must be zero. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
