Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753099AbbBWSQE (ORCPT ); Mon, 23 Feb 2015 13:16:04 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:34960 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752163AbbBWSQA (ORCPT ); Mon, 23 Feb 2015 13:16:00 -0500 Date: Mon, 23 Feb 2015 18:15:53 +0000 From: Serge Hallyn To: Christoph Lameter Cc: "Serge E. Hallyn" , Serge Hallyn , Andy Lutomirski , Aaron Jones , "Ted Ts'o" , linux-security-module@vger.kernel.org, akpm@linuxfoundation.org, "Andrew G. Morgan" , Mimi Zohar , Austin S Hemmelgarn , Markku Savela , Jarkko Sakkinen , linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Michael Kerrisk , Jonathan Corbet Subject: Re: [PATCH] capabilities: Ambient capability set V1 Message-ID: <20150223181553.GE25477@ubuntumail> References: <20150223161625.GD25477@ubuntumail> <20150223164623.GB32181@mail.hallyn.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 752 Lines: 18 Quoting Christoph Lameter (cl@linux.com): > On Mon, 23 Feb 2015, Serge E. Hallyn wrote: > > > > I do not see a problem with dropping privilege since the ambient set > > > is supposed to be preserved across a drop of priviledge. > > > > Because you're tricking the program into thinking it has dropped > > the privilege, when in fact it has not. > > So the cap was dropped from the cap perm set but it is still active > in the ambient set? Right, and the legacy program doesn't know to check the new set. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/