Re: [PATCH 2/2] openat2: add OA2_INHERIT_CRED flag

[stsp]

22.04.2024 22:53, Stefan Metzmacher пишет:
> I'm wondering if it would be better to capture the whole cred structure.
>
> Similar to io_register_personality(), which uses get_current_cred().
>
> Only using uid and gid, won't reflect any group memberships or 
> capabilities... 
I ended up posting v3 where the
group memberships are added but
the rest, including capabilities, is
omitted to avoid security risks.

Does adding just a groupinfo to the
set of overridden members (which is
now: fsuid, fsgid and group_info) address
your concern?
I really think that raising caps is far
out of the scope for my approach, which
aims to be safe and simple. Someone
else can do that later, if need be.