Hello Matthew, On 08/20/2016 08:36 AM, Matthew Saunders wrote: > Issue: capabilities.7 does not mention nosuid > Patch applies to version 4.07 or 4.08? (pulled from > http://git.kernel.org/pub/scm/docs/man-pages/man-pages > on 2016-08-19, the repo isn't clear if it contains the latest release > or the in-progress next version.) > > This patch is the result of my investigation/struggle documented at: > http://stackoverflow.com/questions/38965819/file-capabilities-do-not-transfer-to-process-once-executed > (and multiple other similar questions across the web which can be > found by searching for "capabilities nosuid"). > > Relevant kernel code snippet at: > https://github.com/torvalds/linux/blob/a867d7349e94b6409b08629886a819f802377e91/security/commoncap.c#L456 > > ***** > diff -u output below: (Minor nit: "git diff", or "git format-patch" generates a patch that is a little easier to work with.) > > --- ../man-pages/man7/capabilities.7 2016-08-19 15:51:40.683061817 -0400 > +++ capabilities.7 2016-08-19 15:54:14.511732428 -0400 > @@ -804,6 +804,13 @@ > then the effective flag must also be specified as enabled > for all other capabilities for which the corresponding permitted or > inheritable flags is enabled. > +.RE > + > +Note that file capability sets are ignored if the executable file > +is stored on a filesystem mounted > +.RB ( mount (2), > +.BR mount (8)) > +with the nosuid option. > .\" > .SS Transformation of capabilities during execve() > .PP Thanks for that patch! The man page should already have said this :-(. Applied. Cheers, Michael -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/ -- To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
