<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 05/28/2014 01:52 PM, Mantas Mikulėnas wrote: </div> <blockquote cite="mid:CAPWNY8VFvEGAXG13qbmZRyhwD2E-F-uxhWZ6-4VMryYFVY=UUg@mail.gmail.com" type="cite"> <pre wrap="">Not sure what security hole you see here. If the executable owns cap_foo=ei (*not* cap_foo=eip), then running it will not grant any capabilities unless its process (or the parent process) explicitly adds them to the inheritable set...</pre> </blockquote> And that's the solution - using "ei" instead of "eip". Why I haven't thought about it earlier... Thank you very much! BRs, Michal </body> </html>