From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754470AbbBZS2h (ORCPT ); Thu, 26 Feb 2015 13:28:37 -0500 Received: from resqmta-ch2-02v.sys.comcast.net ([69.252.207.34]:33653 "EHLO resqmta-ch2-02v.sys.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754009AbbBZS2d (ORCPT ); Thu, 26 Feb 2015 13:28:33 -0500 Date: Thu, 26 Feb 2015 12:28:30 -0600 (CST) From: Christoph Lameter X-X-Sender: cl@gentwo.org To: "Serge E. Hallyn" cc: Serge Hallyn , Serge Hallyn , Andy Lutomirski , Aaron Jones , "Ted Ts'o" , linux-security-module@vger.kernel.org, akpm@linuxfoundation.org, "Andrew G. Morgan" , Mimi Zohar , Austin S Hemmelgarn , Markku Savela , Jarkko Sakkinen , linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Michael Kerrisk , Jonathan Corbet Subject: Re: [PATCH] capabilities: Ambient capability set V1 In-Reply-To: <20150226153524.GC15182@mail.hallyn.com> Message-ID: References: <20150223164623.GB32181@mail.hallyn.com> <20150223181553.GE25477@ubuntumail> <20150224051928.GA14755@mail.hallyn.com> <20150224154715.GA20682@mail.hallyn.com> <20150224164429.GB29685@ubuntumail> <20150225033247.GC29685@ubuntumail> <20150226153524.GC15182@mail.hallyn.com> Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 26 Feb 2015, Serge E. Hallyn wrote: > > Well doing that breaks su. > > Don't what exactly? You're saying that doing > > pI' = pI > pA' = pA (pA is ambient) > pP' = (X & fP) | (pI & (fI | pA)) > pE' = pP' & (fE | pA) > > stopped su from having CAP_SETGID while > > pI' = pI > pA' = pA (pA is ambient) > pP' = (X & fP) | (pI & (fI | pA)) > pE' = pP' & fE > > worked? I'll hope you're saying both "fail", in which case fE does not exist in cpu_vfs_cap_data. We only get fI and fP. Why in the world does setcap allow setting fE? V1 does not use fE. In my newer attempt, I seemed to have worked with zeroed field that I assumed was filled in. I will just do pE' = pP' Ok? From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Lameter Subject: Re: [PATCH] capabilities: Ambient capability set V1 Date: Thu, 26 Feb 2015 12:28:30 -0600 (CST) Message-ID: References: <20150223164623.GB32181@mail.hallyn.com> <20150223181553.GE25477@ubuntumail> <20150224051928.GA14755@mail.hallyn.com> <20150224154715.GA20682@mail.hallyn.com> <20150224164429.GB29685@ubuntumail> <20150225033247.GC29685@ubuntumail> <20150226153524.GC15182@mail.hallyn.com> Content-Type: TEXT/PLAIN; charset=US-ASCII Return-path: In-Reply-To: <20150226153524.GC15182-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: "Serge E. Hallyn" Cc: Serge Hallyn , Serge Hallyn , Andy Lutomirski , Aaron Jones , Ted Ts'o , linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, akpm-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org, "Andrew G. Morgan" , Mimi Zohar , Austin S Hemmelgarn , Markku Savela , Jarkko Sakkinen , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Michael Kerrisk , Jonathan Corbet List-Id: linux-api@vger.kernel.org On Thu, 26 Feb 2015, Serge E. Hallyn wrote: > > Well doing that breaks su. > > Don't what exactly? You're saying that doing > > pI' = pI > pA' = pA (pA is ambient) > pP' = (X & fP) | (pI & (fI | pA)) > pE' = pP' & (fE | pA) > > stopped su from having CAP_SETGID while > > pI' = pI > pA' = pA (pA is ambient) > pP' = (X & fP) | (pI & (fI | pA)) > pE' = pP' & fE > > worked? I'll hope you're saying both "fail", in which case fE does not exist in cpu_vfs_cap_data. We only get fI and fP. Why in the world does setcap allow setting fE? V1 does not use fE. In my newer attempt, I seemed to have worked with zeroed field that I assumed was filled in. I will just do pE' = pP' Ok?