Re: [PATCH] Completely honor prctl(PR_SET_KEEPCAPS, 1)

[Dax Kelson]

On Wed, 8 May 2002, [e-mail] wrote:

> Are you sure about the current behaviour? Taking vsftpd as an example, it
> does
> 
1 prctl()
2 setuid()
3 setgid()
4 cap_set_proc()
 
> i.e. it only fiddles with capabilities after dropping euid == 0. Of
> course, someone is welcome to fiddle with capabilities while euid == 0.

Sure this can be done before and after the proposed patch, end results are
the same.  The difference would be what the effective caps are at step
3.5.

The point is when doing PR_SET_KEEPCAPS, one would expect not to have my
caps fiddled with at all.

Dax