Re: [PATCH] proc: don't show nonexistent capabilities (v2)

2012-10-08 Thread Serge Hallyn
Quoting Kees Cook (keesc...@chromium.org): > On Sun, Oct 7, 2012 at 2:56 AM, Andrew Vagin wrote: > > Without this patch it is really hard to interpret a bounding set, > > if CAP_LAST_CAP is unknown for a current kernel. > > > > Non-existant capabilities can not be deleted from a bounding set > >

Re: [PATCH] proc: don't show nonexistent capabilities (v2)

2012-10-08 Thread Serge Hallyn
Quoting Kees Cook (keesc...@chromium.org): On Sun, Oct 7, 2012 at 2:56 AM, Andrew Vagin ava...@openvz.org wrote: Without this patch it is really hard to interpret a bounding set, if CAP_LAST_CAP is unknown for a current kernel. Non-existant capabilities can not be deleted from a bounding

Re: [PATCH] proc: don't show nonexistent capabilities (v2)

2012-10-07 Thread Kees Cook
On Sun, Oct 7, 2012 at 2:56 AM, Andrew Vagin wrote: > Without this patch it is really hard to interpret a bounding set, > if CAP_LAST_CAP is unknown for a current kernel. > > Non-existant capabilities can not be deleted from a bounding set > with help of prctl. > > E.g.: Here are two examples

[PATCH] proc: don't show nonexistent capabilities (v2)

2012-10-07 Thread Andrew Vagin
Without this patch it is really hard to interpret a bounding set, if CAP_LAST_CAP is unknown for a current kernel. Non-existant capabilities can not be deleted from a bounding set with help of prctl. E.g.: Here are two examples without/with this patch. CapBnd: ffe0fdec CapBnd:

[PATCH] proc: don't show nonexistent capabilities (v2)

2012-10-07 Thread Andrew Vagin
Without this patch it is really hard to interpret a bounding set, if CAP_LAST_CAP is unknown for a current kernel. Non-existant capabilities can not be deleted from a bounding set with help of prctl. E.g.: Here are two examples without/with this patch. CapBnd: ffe0fdec CapBnd:

Re: [PATCH] proc: don't show nonexistent capabilities (v2)

2012-10-07 Thread Kees Cook
On Sun, Oct 7, 2012 at 2:56 AM, Andrew Vagin ava...@openvz.org wrote: Without this patch it is really hard to interpret a bounding set, if CAP_LAST_CAP is unknown for a current kernel. Non-existant capabilities can not be deleted from a bounding set with help of prctl. E.g.: Here are two