[PATCH] Manual pages: cap_from_text.3: Clarify a detail of cap_from_text() action list

Michael Kerrisk (man-pages) mtk.manpages at gmail.com
Wed Jul 22 21:00:01 UTC 2020


The fact that the action list of a cap_from_text() clause can include
multiple operator-flag pairs is a little hidden in this page. Make it
clearer by separating this information out into a separate paragraph and
showing an example of the equivalence to multple clauses.

Signed-off-by: Michael Kerrisk (man-pages) <mtk.manpages at gmail.com>
---
 doc/cap_from_text.3 | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/doc/cap_from_text.3 b/doc/cap_from_text.3
index e59ca59..9f4c50b 100644
--- a/doc/cap_from_text.3
+++ b/doc/cap_from_text.3
@@ -139,9 +139,16 @@ capability list and one or more explicit trailing flags.  The `+'
 operator will raise all of the listed capabilities in the flagged
 capability sets.  The `\-' operator will lower all of the listed
 capabilities in the flagged capability sets.  For example:
-"all+p" will raise all of the Permitted capabilities; "cap_fowner+p\-i"
-will raise the override-file-ownership capability in the Permitted
-capability set and lower this Inheritable capability;
+"all+p" will raise all of the Permitted capabilities and
+"cap_fowner\-i" will lower the override-file-ownership in the Inheritable set.
+.PP
+The action list can consist of multiple
+.I operator flag
+pairs; the actions are performed in left-to-right order.
+Thus, for example,
+"cap_fowner+p\-i"
+is equivalent to "cap_fowner+p cap_fowner\-i".
+As another example,
 "cap_fowner+pe\-i" and "cap_fowner=+pe" are equivalent.
 .SH "RETURN VALUE"
 .BR cap_from_text (),
-- 
2.26.2



More information about the Linux-security-module-archive mailing list