From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757714AbYEEIWW (ORCPT ); Mon, 5 May 2008 04:22:22 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753331AbYEEIWJ (ORCPT ); Mon, 5 May 2008 04:22:09 -0400 Received: from rv-out-0506.google.com ([209.85.198.227]:52721 "EHLO rv-out-0506.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754657AbYEEIWH (ORCPT ); Mon, 5 May 2008 04:22:07 -0400 DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=j32TdGbgRhM2DchEhLtTBjn2kpeowXreEAvxX+iQtdCwvw+q6QpMeAFYWnUF31re7K0Fek7MYUxpnbDtxJLWgZz/+uaSqZBms1yEqtFqmfPpwZTgu6lRZ3JI8SiiEvNESI/mOWOzeFmUg+Q8ZaSXJIE5NTeGm8bodjaD8wloLXw= Message-ID: Date: Mon, 5 May 2008 10:22:06 +0200 From: "Michael Kerrisk" To: "Andrew Morgan" Subject: Re: [PATCH] capabilities: add bounding set to /proc/self/status Cc: "Chris Wright" , "Serge E. Hallyn" , lkml , linux-security-module@vger.kernel.org, "Michael Kerrisk" , "Andrew Morton" , "Linus Torvalds" In-Reply-To: <20080502003730.GA4018@sequoia.sous-sol.org> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <20080501183559.GA21279@sergelap.austin.ibm.com> <20080502003730.GA4018@sequoia.sous-sol.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Andrew (Morgan), It looks like this didn't make it into rc1, even though it was sent within the merge window -- perhaps Linus or Andrew (Morton) needed to be explicitly CCed? Cheers, Michael On Fri, May 2, 2008 at 2:38 AM, Chris Wright wrote: > * Serge E. Hallyn (serue@us.ibm.com) wrote: > > There is currently no way to query the bounding set of another > > task. As there appears to be no security reason not to, and > > as Michael Kerrisk points out the following valid reasons to do > > so exist: > > > > * consistency (I can see all of the other per-thread/process sets in > > /proc/.../status) > > * debugging -- I could imagine that it would make the job of debugging > > an application that uses capabilities a little simpler. > > > > this patch adds the bounding set to /proc/self/status right after > > the effective set. > > > > If at all possible (and if acked by Andrew Morgan) it would be nice to > > get this into the 2.6.26 cycle. But I realize it probably is too late > > for that. > > I've no issue with this. > > > Signed-off-by: Serge E. Hallyn > > Acked-by: Michael Kerrisk > > Acked-by: Chris Wright > > > > --- > > fs/proc/array.c | 1 + > > 1 files changed, 1 insertions(+), 0 deletions(-) > > > > diff --git a/fs/proc/array.c b/fs/proc/array.c > > index c135cbd..160dd4a 100644 > > --- a/fs/proc/array.c > > +++ b/fs/proc/array.c > > @@ -297,6 +297,7 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p) > > render_cap_t(m, "CapInh:\t", &p->cap_inheritable); > > render_cap_t(m, "CapPrm:\t", &p->cap_permitted); > > render_cap_t(m, "CapEff:\t", &p->cap_effective); > > + render_cap_t(m, "CapBnd:\t", &p->cap_bset); > > } > > > > static inline void task_context_switch_counts(struct seq_file *m, > -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Found a bug? http://www.kernel.org/doc/man-pages/reporting_bugs.html