lkml.org 
[lkml]   [2015]   [Sep]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v2] capabilities.7, prctl.2: Document ambient capabilities
From
On Tue, Sep 29, 2015 at 10:49 AM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Tue, Sep 29, 2015 at 10:47 AM, Kees Cook <keescook@chromium.org> wrote:
>> On Mon, Sep 28, 2015 at 6:03 PM, Andy Lutomirski <luto@kernel.org> wrote:
>>> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>>> ---
>>> man2/prctl.2 | 12 ++++++++++++
>>> man7/capabilities.7 | 40 ++++++++++++++++++++++++++++++++++------
>>> 2 files changed, 46 insertions(+), 6 deletions(-)
>>>
>>> diff --git a/man2/prctl.2 b/man2/prctl.2
>>> index e743a6305969..5bcec391c110 100644
>>> --- a/man2/prctl.2
>>> +++ b/man2/prctl.2
>>> @@ -954,6 +954,18 @@ had been called.
>>> For further information on Intel MPX, see the kernel source file
>>> .IR Documentation/x86/intel_mpx.txt .
>>> .\"
>>> +.TP
>>> +.BR PR_CAP_AMBIENT " (since Linux 4.2)"
>>> +Reads or changes the ambient capability set. If arg2 is PR_CAP_AMBIENT_RAISE,
>>> +then the capability specified in arg3 is added to the ambient set. This will
>>> +fail, returning EPERM, if the capability is not already both permitted and
>>> +inheritable or if the SECBIT_NO_CAP_AMBIENT_RAISE securebit is set. If arg2
>>> +is PR_CAP_AMBIENT_LOWER, then the capability specified in arg3 is removed
>>> +from the ambient set. If arg2 is PR_CAP_AMBIENT_IS_SET, then
>>> +.BR prctl (2)
>>> +will return 1 if the capability in arg3 is in the ambient set and 0 if not.
>>> +If arg2 is PR_CAP_AMBIENT_CLEAR_ALL, then all capabilities will
>>> +be removed from the ambient set.
>>
>> In the case of CLEAR_ALL, is arg3 "don't care", or must it be set to 0?
>
> Must be zero.

Okay, cool. Probably that should be noted here.

-Kees

--
Kees Cook
Chrome OS Security


\
 
 \ /
  Last update: 2015-09-29 20:21    [W:0.065 / U:0.440 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site