tree cc3ac22a6944700a3331ba085dd71f053f845838
parent 6482e8d2d70407a190e7eea4aeb895da0ed19cb1
author Jorge Lucangeli Obes <jorgelo@google.com> 1455923049 -0800
committer Jorge Lucangeli Obes <jorgelo@google.com> 1455924018 -0800

Add support for dropping capabilities from the bounding set.

Android daemons such as adbd need to drop capabilities from their
bounding sets (to prevent processes they launch from gaining privileges
through file capabilities), but not from their runtime
(permitted|inheritable|effective) sets. Add support for this and rename
some capability-related code to make things clearer.

While in there, fix a comment in the Android makefile.

Bug: 27274137
Change-Id: I7cab7e3302bb34cd7859b9621906391104bf6b4e