Hello, after checking POSIX 1003.1e draft 17 more thoroughly, it turned out that we have the following situation: Draft 17 mentions the CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_DAC_WRITE, and CAP_DAC_EXECUTE capabilities (among others). In Appendix B (pp.319) it says that ``the group also considered a single CAP_DAC_OVERRIDE capability, but this granularity was considered insufficient'' for reasons explained there. The group decided to split CAP_DAC_OVERRIDE into CAP_DAC_READ_SEARCH, CAP_DAC_WRITE, and CAP_DAC_EXECUTE. The deprecated CAP_DAC_OVERRIDE capability is still mentioned in several places in the draft 17 text, but not in the table that defines the base set of required capabilities. So it appears that Andrew Morgan based the Linux Capabilities implementation on an earlier draft. Replacing CAP_DAC_OVERRIDE with the split capabilities does not seem a reasonable thing to do to me at this point. So I believe that the attached patch is a sufficient fix for the POSIX non-compliance bug (thread http://marc.theaimsgroup.com/?l=linux-kernel&m=106631710402696&w=2). The previous version of the fix for this problem that was posted to LKML was not granting execute access to directories that had no execute bits set. This was causing the problems observed. Checking for execute bits makes sense for regular files, because it prevents privileged users from trying to execute random files. The operation of traversing a directory is different from executing an arbitrary file, because it always has ``reasonable'' semantics. We had the equivalent of the attached patch included for about a month now, so IMO the patch is safe to apply. Cheers, -- Andreas Gruenbacher SUSE Labs, SUSE LINUX AG