Re: chflags -RL and symlinks pointing outside the traversal: preserve behavior or add a Capsicum guardrail?

On Fri, Aug 21, 2026 at 04:48:38AM +0300, Konstantin Belousov wrote:
> On Thu, Aug 20, 2026 at 10:41:22AM -0400, Mark Johnston wrote:
> > In general, when capsicumizing utilities we try to avoid changing the
> > behaviour.  Here, we have no choice, and there's not much precedent for
> > that that I'm aware of.
> > 
> > I still think we should provide some way to work around any
> > compatibility problems.  Maybe, /rescue/chflags should not enter
> > capability mode, and the workaround would be to use that instead.
> > That's not a very general solution though.
> IMO there must be an option to disable the capability mode.
> Ideally, the option would be consistent across most of the utilities.

I think this will require a long option, as Alan mentioned.
--dereference-links-unsafely seems okay.

> Also, if we are talking about making the capsicum entry semi-mandatory,
> as the first step we should remove the CAPABILITIES/CAPABILITY_MODE
> options from kernel build. (To make it clear, make the features
> unconditional).

I wonder if anyone actually disables them?  There is some marginal
performance benefit to doing so, for applications which manage large
numbers of file descriptors.

I do not object to removing those options, in any case.  Doing so would
simplify a bunch of quite complicated code.