xref: /aosp_15_r20/external/libcap/doc/values/8.txt (revision 2810ac1b38eead2603277920c78344c84ddf3aff)
1Allows a process to freely manipulate its inheritable
2capabilities.
3
4Linux supports the POSIX.1e Inheritable set, the POXIX.1e (X
5vector) known in Linux as the Bounding vector, as well as
6the Linux extension Ambient vector.
7
8This capability permits dropping bits from the Bounding
9vector (ie. raising B bits in the libcap IAB
10representation). It also permits the process to raise
11Ambient vector bits that are both raised in the Permitted
12and Inheritable sets of the process. This capability cannot
13be used to raise Permitted bits, Effective bits beyond those
14already present in the process' permitted set, or
15Inheritable bits beyond those present in the Bounding
16vector.
17
18[Historical note: prior to the advent of file capabilities
19(2008), this capability was suppressed by default, as its
20unsuppressed behavior was not auditable: it could
21asynchronously grant its own Permitted capabilities to and
22remove capabilities from other processes arbitrarily. The
23former leads to undefined behavior, and the latter is better
24served by the kill system call.]
25