the inheritable set is used only for calculating the new capability sets after exec().
可继承集只用于在执行 exec()之后计算新的能力集。
the file inheritable set is the set that can be inherited from the parent process「s inheritable set into its new permitted set.
文件可继承集中的能力可以从父进程的可继承集继承到新的允许集。
if a non-root user runs this program while running with full capabilities, its inheritable set pi is first masked against fi so it is reduced to just cap_sys_admin.
如果一个非根用户在拥有所有能力的情况下运行这个程序,首先计算它的可继承集(pi)和fi 的交集,所以缩减到只包含 cap_sys_admin。
in contrast, if a completely unprivileged user runs this same program, his empty inheritable set is masked against fi, resulting in the empty set.
另一方面,如果一个完全没有特权的用户运行同一个程序,他的可继承集是空的,这个集与fi 求交集,会产生一个空集。
the file permitted set, also known as the 「forced」 set, is the set that is forced on in the new permitted set, regardless of whether it was in the task」s inheritable set or not.
文件允许集也称为 「强迫(forced)」集,其中的能力总是出现在新的进程允许集中,无论这些能力是否在任务的可继承集中。