You can remove all unneeded capabilities from the permitted set, such that they cannot be regained.
可以从允许集中删除所有不需要的能力，这样就无法恢复这些能力。
Until now, we have asserted the desired capabilities in the permitted set but not the inheritable set.
到目前为止，我们已经在允许集中设置了所需的能力，但是还没有在可继承集中设置。
The file inheritable set specifies which of the process's inheritable capabilities can be in the process's new permitted set.
文件可继承集决定进程的哪些可继承能力可以放在新的进程允许集中。
The process can change the contents of the effective set at any time as long as the effective set does not exceed the permitted set.
只要有效集不超过允许集的范围，进程任何时候都可以修改有效集的内容。
You can remove the capabilities from the effective set but retain them in the permitted set to prevent inadvertent abuse of the capabilities.
可以将能力从有效集(effectiveset)中删除，但是保留在允许集(permitted set)中，从而防止滥用能力。
The new permitted set is taken as a union of the file's permitted set and the result of intersecting the file's and process's inheritable sets.
新的允许集是文件的允许集与文件和进程的可继承集的交集合并的结果。
If it is compromised, the attacker can use only the capabilities present in the effective set, or, with a call to cap_set_proc (3), in its permitted set.
如果攻击者突破了这个程序，他也只能使用有效集中的能力；即使调用了cap_set _ proc(3)，也只能使用允许集中的能力。
If it is compromised, the attacker can use only the capabilities present in the effective set, or, with a call to cap_set_proc (3), in its permitted set.
如果攻击者突破了这个程序，他也只能使用有效集中的能力；即使调用了cap_set _ proc(3)，也只能使用允许集中的能力。
应用推荐