validate: fix cap validation

[zhouhao3]

Signed-off-by: zhouhao [email protected]

[Mashimiao]

This is not a correct fix. The manpage says The ambient capability set obeys the invariant that no capability can ever be ambient if it is not both permitted and inheritable. So just keep&&

[zhouhao3]

My understanding is that both the permitted and the inheritable are valid for flase, but in the current case, when one of them is false, it is executed, which is not in accordance with the rules.
Also we need to change effective to permitted.

[wking]

On Thu, Sep 28, 2017 at 08:24:38AM +0000, Zhou Hao wrote: Also we need to change `effective` to `permitted`.

I agree with this, but as @Mashimiao points out [1], we want to keep &&. Demonstrating in Python, but the boolean logic is true regardless of language: for permitted in (True, False): for inheritable in (True, False): ambient_legal = (permitted and inheritable) print('permitted: {}, inheritable: {}, ambient legal: {}'.format(permitted, inheritable, ambient_legal)) permitted: True, inheritable: True, ambient legal: True permitted: True, inheritable: False, ambient legal: False permitted: False, inheritable: True, ambient legal: False permitted: False, inheritable: False, ambient legal: False However, the code you have in 1333713 produces: for permitted in (True, False): for inheritable in (True, False): ambient_legal = (permitted or inheritable) print('permitted: {}, inheritable: {}, ambient legal: {}'.format(permitted, inheritable, ambient_legal)) # permitted: True, inheritable: True, ambient legal: True # permitted: True, inheritable: False, ambient legal: True # permitted: False, inheritable: True, ambient legal: True # permitted: False, inheritable: False, ambient legal: False If the currrent !(A && B) is confusing, you can unpack with DeMorgan's law [2]: ambient && (!permitted || !inheritable) And a great way to make sure we're doing this right is to have unit tests excercising CheckCapabilities in the different cases :). [1]: #488 (comment) [2]: https://en.wikipedia.org/wiki/De_Morgan's_laws

[wking]

This PR should be part of v0.3.0. As a config-validation bugfix, it really belonged in v0.2.0, but we've cut v0.2.0, and v0.3.0 is the next-most-urgent milestone ;).

[zhouhao3]

 # permitted: True, inheritable: True, ambient legal: True 
 # permitted: True, inheritable: False, ambient legal: True 
 # permitted: False, inheritable: True, ambient legal: True 
 # permitted: False, inheritable: False, ambient legal: False

I think this is the right result, exactly what I want. So my changes are correct and do not need to be modified.Only if permitted and inheritable are false, ambient is false.

[wking]

permitted: True, inheritable: False, ambient legal: True

This is not both permitted and inheritable.

[zhouhao3]

Sorry, I misunderstood.

[Mashimiao]

LGTM

[zhouhao3]

ping @liangchenye @hqhq @mrunalp

[zhouhao3]

@liangchenye @hqhq PTAL

[liangchenye]

LGTM