Capability bit defaults for an executable:
fI = 0x00000000fffffeff;
fP = 0x0000000000000000; /* for traditional setuid-root, this is full */
fE = 0x00000000fffffeff;
fN = 0x0000000000000000; /* for traditional setuid-root, this is full */
fX = 0x00000000fffffeff;
The fN value is the miNimum needed to correctly execute.
The fX value is the maXimum that this executable is trusted with.
These help protect against buggy software.
The default values for fI, fE, and fX might be adjustable.
Files also have fK, the "bits known to the setup tool". Anything not
found in fK will be determined from the default values above. This is
important, because newly defined bits may include normal user abilities
that were simply expected when the executable was marked. It also gives
developers the ability to safely split one bit into two bits.
new_pP = fP | (fI & old_pI) | (old_pP & config_option_1 & fX);
new_pE = (new_pP & fE);
new_pI = (old_pI & fX) | (new_pP & config_option_2);
if((new_pP & fN) != fN) return -EPERM;
With the config options full, you get better UNIX compatibility.
With the config options empty, you get the withdrawn draft standard.
Config options could be global, inherited, or assigned to login ID
values (which Linux does not yet support).
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/