Issue: capabilities.7 does not mention nosuid Patch applies to version 4.07 or 4.08? (pulled from http://git.kernel.org/pub/scm/docs/man-pages/man-pages on 2016-08-19, the repo isn't clear if it contains the latest release or the in-progress next version.) This patch is the result of my investigation/struggle documented at: http://stackoverflow.com/questions/38965819/file-capabilities-do-not-transfer-to-process-once-executed (and multiple other similar questions across the web which can be found by searching for "capabilities nosuid"). Relevant kernel code snippet at: https://github.com/torvalds/linux/blob/a867d7349e94b6409b08629886a819f802377e91/security/commoncap.c#L456 ***** diff -u output below: --- ../man-pages/man7/capabilities.7 2016-08-19 15:51:40.683061817 -0400 +++ capabilities.7 2016-08-19 15:54:14.511732428 -0400 @@ -804,6 +804,13 @@ then the effective flag must also be specified as enabled for all other capabilities for which the corresponding permitted or inheritable flags is enabled. +.RE + +Note that file capability sets are ignored if the executable file +is stored on a filesystem mounted +.RB ( mount (2), +.BR mount (8)) +with the nosuid option. .\" .SS Transformation of capabilities during execve() .PP ***** Regards, Matt -- To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
