From the manual:
P'(ambient) = (file is privileged) ? 0 : P(ambient)
It is possible for a process to gain privileges from its parent.
P'(permitted) = (P(inheritable) & F(inheritable)) |
(F(permitted) & cap_bset) | P'(ambient)
It is possible for a process to gain privileges from a file, if its inheritable set has them, or its cap_bset has them.
P'(effective) = F(effective) ? P'(permitted) : P'(ambient)
P'(inheritable) = P(inheritable) [i.e., unchanged]
It gets its inherited set from its parents
P denotes the value of a thread capability set before the
P' denotes the value of a thread capability set after the
F denotes a file capability set
cap_bset is the value of the capability bounding set (described
Note that the bounding set masks the file permitted capabilities, but
not the inheritable capabilities. If a thread maintains a capability
in its inheritable set that is not in its bounding set, then it can
still gain that capability in its permitted set by executing a file
that has the capability in its inheritable set.
You also need to remove from
Therefore remove privileges from the root process (
init): remove privileges from