class CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test
Defined at line 1529 of file ../../src/starnix/tests/syscalls/cpp/capabilities_test.cc
From
<https
://man7.org/linux/man-pages/man7/capabilities.7.html>:
When executing a capability-dumb binary, the kernel checks if the
process obtained all permitted capabilities that were specified in the
file permitted set [...]. If the process did not obtain the full set of
file permitted capabilities, then execve(2) fails with the error EPERM.
From
<https
://man7.org/linux/man-pages/man2/execve.2.html>:
The set-user-ID and set-group-ID mode bits of a program are ignored if
any of the following is true:
• the no_new_privs attribute is set for the calling thread;
...
The capabilities of the program file (see capabilities(7)) are also
ignored if any of the above are true.
Observed:
Under PR_SET_NO_NEW_PRIVS, rather than treating file capabilities as empty
or failing with EPERM for a capability-dumb binary, execve(2) intersects
P'(permitted) with P(permitted), retaining file capabilities already held
by the caller while masking out unheld file capabilities.
Public Methods
void CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test ()Defined at line 1529 of file ../../src/starnix/tests/syscalls/cpp/capabilities_test.cc
void CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test (const CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test & )Defined at line 1529 of file ../../src/starnix/tests/syscalls/cpp/capabilities_test.cc
void CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test (CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test && )Defined at line 1529 of file ../../src/starnix/tests/syscalls/cpp/capabilities_test.cc
CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test & operator= (const CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test & )Defined at line 1529 of file ../../src/starnix/tests/syscalls/cpp/capabilities_test.cc
CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test & operator= (CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test && )Defined at line 1529 of file ../../src/starnix/tests/syscalls/cpp/capabilities_test.cc
void ~CapsExecTest_FileEffectiveCapsMaskedByNoNewPrivs_Test ()Defined at line 1529 of file ../../src/starnix/tests/syscalls/cpp/capabilities_test.cc