def CapState.valid

bend-osdev-caps@0.1.0.0 · caps.bend:444

import Base

444# capabilities(7)'s invariants: effective within permitted, and no capability
445# ambient unless it is both permitted and inheritable
446def CapState.valid(s: CapState) -> Bool:
447  match s:
448    case CapState{+p, +i, e, b, +a}:
449      Bool.and(CapSet.subset(e, p), Bool.and(CapSet.subset(a, p), CapSet.subset(a, i)))