Hi Casey, That simple patch makes load-self(2) being continuously restrictive, what means that dropped rights aren't recoverable without having CAP_MAC_ADMIN. As you know, this "self" restriction rules are inherited by processes after exec and copied by fork. Then having that modification would allow smack aware applications to trust that the restrictions they made for themselfs, for their subcomponents or for their subprocesses are respected. What do you think of it? Best regards José diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 160aa08..9b71ee5 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -210,7 +210,8 @@ static int smk_set_access(struct smack_parsed_rule *srp, if (sp->smk_object == srp->smk_object && sp->smk_subject == srp->smk_subject) { found = 1; - sp->smk_access |= srp->smk_access1; + if (global || smack_privileged(CAP_MAC_ADMIN)) + sp->smk_access |= srp->smk_access1; sp->smk_access &= ~srp->smk_access2; break; }