Subject capabilities: close the ways around the CAP_SETFCAP rule for uid 0
Author josef@toxicpanda.com
Date 2026-10-06 15:44:17 +0000 UTC
Version
Cc brauner@kernel.org dhowells@redhat.com jarkko@kernel.org jmorris@namei.org josef@toxicpanda.com keyrings@vger.kernel.org linux-fsdevel@vger.kernel.org linux-kernel@vger.kernel.org linux-security-module@vger.kernel.org morgan@kernel.org paul@paul-moore.com serge@hallyn.com sergeh@kernel.org
Patches (5)
Name Content [All]
[PATCH 1/5] cred: record how far up CAP_SETFCAP reaches [Body]
[PATCH 2/5] userns: don't let setns() lend the right to map uid 0 [Body]
[PATCH 3/5] userns: check the writer too before mapping uid 0 [Body]
[PATCH 4/5] capabilities: limit fscaps to where CAP_SETFCAP reaches [Body]
[PATCH 5/5] capabilities: don't let ptrace borrow CAP_SETFCAP [Body]
Series Summary
Passed
✓ All tests passed. No findings.
Sessions
Session 2026-10-06
Passed
ID (for dev) b86e1463-dced-4d90-9b95-14935fda7b27
Status finished
Triaged OK [Log] [Trajectory]
Execution Log [Link]
Test Base Patched Verdict
[KASAN] Build Base 7909a3e30a05e40bbc8bfb7f5629ed642abeaab8 [Config] passed [Log]
[KASAN] Boot test: Base 7909a3e30a05e40bbc8bfb7f5629ed642abeaab8 [Config] passed [Log]
[KASAN] Build Patched 7909a3e30a05e40bbc8bfb7f5629ed642abeaab8 [Config] [patched] passed [Log]
[KASAN] Boot test: Patched 7909a3e30a05e40bbc8bfb7f5629ed642abeaab8 [Config] [patched] passed [Log]
[KASAN] Fuzz 7909a3e30a05e40bbc8bfb7f5629ed642abeaab8 [Config] 7909a3e30a05e40bbc8bfb7f5629ed642abeaab8 [Config] [patched] passed [Log] [Artifacts]