Subject capabilities: close the ways around the CAP_SETFCAP rule for uid 0
Author josef@toxicpanda.com
Date 2026-10-22 18:36:19 +0000 UTC
Version
Cc brads@mainlining.org brauner@kernel.org dhowells@redhat.com jarkko@kernel.org jmorris@namei.org josef@toxicpanda.com keyrings@vger.kernel.org linux-fsdevel@vger.kernel.org linux-kernel@vger.kernel.org linux-security-module@vger.kernel.org morgan@kernel.org paul@paul-moore.com serge@hallyn.com sergeh@kernel.org
Patches (5)
Name Content [All]
[PATCH v4 1/5] userns: record how far up CAP_SETFCAP reaches [Body]
[PATCH v4 2/5] userns: don't let setns() lend CAP_SETFCAP [Body]
[PATCH v4 3/5] userns: check the opener and the writer before mapping uid 0 [Body]
[PATCH v4 4/5] capabilities: limit fscaps to where CAP_SETFCAP reaches [Body]
[PATCH v4 5/5] capabilities: don't let ptrace borrow CAP_SETFCAP [Body]
Series Summary
Passed
✓ All tests passed. No findings.
Sessions
Session 2026-10-22
Passed
ID (for dev) 2952f441-89a2-4735-a175-ba8ab351b701
Status finished
Triaged OK [Log] [Trajectory]
Execution Log [Link]
Test Base Patched Verdict
[KASAN] Build Base 2c3ba1f1cb416b81d617b92a24a4bcaa48d574e3 [Config] passed [Log]
[KASAN] Boot test: Base 2c3ba1f1cb416b81d617b92a24a4bcaa48d574e3 [Config] passed [Log]
[KASAN] Build Patched 2c3ba1f1cb416b81d617b92a24a4bcaa48d574e3 [Config] [patched] passed [Log]
[KASAN] Boot test: Patched 2c3ba1f1cb416b81d617b92a24a4bcaa48d574e3 [Config] [patched] passed [Log]
[KASAN] Fuzz 2c3ba1f1cb416b81d617b92a24a4bcaa48d574e3 [Config] 2c3ba1f1cb416b81d617b92a24a4bcaa48d574e3 [Config] [patched] passed [Log] [Artifacts]