Re: [PATCH V3 02/10] capabilities: intuitive names for cap gain status

Introduce macros cap_gained, cap_grew, cap_full to make the use of the negation of is_subset() easier to read and analyse. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- security/commoncap.c | 16 ++++++++++------ 1 files changed, 10 insertions(+), 6 deletions(-) diff --git a/security/commoncap.c b/security/commoncap.c index b7fbf77..6f05ec0 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -513,6 +513,12 @@ void handle_privileged_root(struct linux_binprm *bprm, bool has_cap, bool *effec *effective = true; } +#define cap_gained(field, target, source) \ + !cap_issubset(target->cap_##field, source->cap_##field) +#define cap_grew(target, source, cred) \ + !cap_issubset(cred->cap_##target, cred->cap_##source) +#define cap_full(field, cred) \ + cap_issubset(CAP_FULL_SET, cred->cap_##field)