[cap-talk] Concening entry "ambient authority" in Wikipedia

[Marcus Brinkmann]

David-Sarah Hopwood wrote:
> Undeniable authorities. They are not capabilities, nor are they accessed
> via capabilities.

This does not appear to be true, as is easily demonstrated.  The capability
name space is the interrupt vector, and the UNIX capability is capability
number 0x80 by convention.  The messages are marshalled in registers and
memory buffers, and the send+receive instruction is "int CAP" where CAP is the
capability name.

This capability can be intercepted and denied by using the ptrace interface,
as is done by programs such as strace, fakeroot or faketime (20 lines of code
for the latter).

The difference is in granularity and practicability within the given defaults,
not in the invocation model.

Thanks,
Marcus