/* This function validates and applies a proposed mass change to the current process's capability sets. The changes are made to the proposed new credentials, and assuming no error, will be committed by the caller of LSM.  */
int cap_capset(struct cred *new, const struct cred *old, const kernel_cap_t *effective, const kernel_cap_t *inheritable, const kernel_cap_t *permitted)
/* This function validates and applies a proposed mass change to the current process's capability sets. The changes are made to the proposed new credentials, and assuming no error, will be committed by the caller of LSM.  */
int cap_capset(struct cred *new, const struct cred *old, const kernel_cap_t *effective, const kernel_cap_t *inheritable, const kernel_cap_t *permitted)
{
	if (cap_inh_is_capped() &&
	    !cap_issubset(*inheritable,
			  cap_combine(old->cap_inheritable,
				      old->cap_permitted)))
		return -EPERM;
	if (!cap_issubset(*inheritable,
			  cap_combine(old->cap_inheritable,
				      old->cap_bset)))
		return -EPERM;
	if (!cap_issubset(*permitted, old->cap_permitted))
		return -EPERM;
	if (!cap_issubset(*effective, *permitted))
		return -EPERM;
	new->cap_effective   = *effective;
	new->cap_inheritable = *inheritable;
	new->cap_permitted   = *permitted;
	return 0;
}