cap: restrict capabilities by a bounding set
A bounding set restricts a file capabilities.
P'(permitted) = (P(inheritable) & F(inheritable)) |
(F(permitted) & cap_bset).
Take into account a follow statement from man capabilities:
"""
When a process execve(2)s a set-user-ID-root program, it gains
all capabilities in its permitted and effective capability sets,
except those masked out by the capability bounding set.
"""
so a bounding set is just one way to restrict capabilities.
An OpenVZ kernel does this by itself for historical reasons.
[kir@openvz.org: improve in-code comments]
1 file changed