From The Linux Programming Interface:
The permitted set is a limiting superset for the capabilities that can be added to the effective and inheritable sets.
Does it mean that the permitted set of a process is a superset of both the effective set and the inheritable set of the process?
The kernel calculates the new capabilities of the process using the following rules:
P'(permitted) = (P(inheritable) & F(inheritable)) | (F(permitted) & cap_bset)
P'(effective) = F(effective) ? P'(permitted) : 0
P'(inheritable) = P(inheritable)
In the above rules, P denotes the value of a capability set prior to the
exec(), P’ denotes the value of a capability set after the
exec(), and F denotes a file capability set. The identifier cap_bset denotes the value of the capability bounding set.
How does the rules guarantee that P'(permitted) is a superset of P'(inheritable)? In other words, can P'(permitted) become not a superset of P(inheritable)?
What does "F(effective) ? P'(permitted) : 0" mean?
F(xxx) sets or bit sets? If latter, are the operations on them bit operations? If former, are the operations on them set operations (union and intersection)?