Messages in this thread Patch in this message | | | From | Andrew Vagin <> | Subject | [PATCH] proc: don't show nonexistent capabilities | Date | Wed, 3 Oct 2012 00:30:32 +0400 |
| |
Without this patch it is really hard to interpret a bounding set, if CAP_LAST_CAP is unknown for a current kernel.
Non-existant capabilities can not be deleted from a bounding set with help of prctl.
E.g.: Here are two examples without/with this patch. CapBnd: ffffffe0fdecffff CapBnd: 00000000fdecffff
I suggest to hide non-existent capabilities. Here is two reasons. * It's logically and easier for using. * It helps to checkpoint-restore capabilities of tasks, because tasks can be restored on another kernel, where CAP_LAST_CAP is bigger.
Cc: Serge Hallyn <serge.hallyn@canonical.com> Cc: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: Andrew Vagin <avagin@openvz.org> --- include/linux/capability.h | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/include/linux/capability.h b/include/linux/capability.h index d10b7ed..1642778 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -420,7 +420,8 @@ extern const kernel_cap_t __cap_init_eff_set; #else /* HAND-CODED capability initializers */ # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }}) -# define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }}) +# define CAP_FULL_SET ((kernel_cap_t){{ ~0, \ + CAP_TO_MASK(CAP_LAST_CAP + 1) - 1 } }) # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \ | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \ CAP_FS_MASK_B1 } }) -- 1.7.1
| |