EL permission rules clarification

[tomaird]

The summary table describes that CL and EL are only cleared if CL=0 on the auth cap (amongst other conditions):

But all the descriptions of EL don't mention that CL must be zero on the auth cap, but do mention all the other conditions. e.g. in LC:

I'm assuming the table is correct and auth_cap.CL=0 is required to clear CL and EL in the data cap, but it's a bit confusing to leave this out of these text descriptions.

Note, this is not a problem for the SL-perm rules which describe the conditions in full.

[jamie-melling]

To me, it seems like changing the CL is more like a demotion than removing a permission. If your auth cap is Global, then you can load Local or Global capabilities, but if your capability is Local, then can only load Local capabilities using it - hence setting CL=0 when auth_cap.CL ==0.
"restricting capability level to the level of the authorizing capability" is more future proof wording if the capability levels were ever increased.

[arichardson]

It looks like this is incorrect, EL should always be cleared if the authorizing cap does not have EL.