Re: [RFC PATCH v4 0/2] Add capabilities file to securityfs

[Paul Moore]

On Mon, Jul 25, 2022 at 8:42 AM Francis Laniel
<flaniel@xxxxxxxxxxxxxxxxxxx> wrote:
> Hi.
>
> First, I hope you are fine and the same for your relatives.

Hi Francis :)

> A solution to this problem could be to add a way for the userspace to ask the
> kernel about the capabilities it offers.
> So, in this series, I added a new file to securityfs:
> /sys/kernel/security/capabilities.
> The goal of this file is to be used by "container world" software to know kernel
> capabilities at run time instead of compile time.

...

> The kernel already exposes the last capability number under:
> /proc/sys/kernel/cap_last_cap

I'm not clear on why this patchset is needed, why can't the
application simply read from "cap_last_cap" to determine what
capabilities the kernel supports?

-- 
paul-moore.com