diff options
| author | Eric Paris <eparis@redhat.com> | 2011-04-01 17:08:28 -0400 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2011-04-04 10:31:06 +1000 |
| commit | 4bf2ea77dba76a22f49db3c10773896aaeeb8f66 (patch) | |
| tree | a59c1f924c022864f259ed56b6326a35ab2ceee2 | |
| parent | 17f60a7da150fdd0cfb9756f86a262daa72c835f (diff) | |
capabilities: do not special case exec of init
When the global init task is exec'd we have special case logic to make sure
the pE is not reduced. There is no reason for this. If init wants to drop
it's pE is should be allowed to do so. Remove this special logic.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: David Howells <dhowells@redhat.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: James Morris <jmorris@namei.org>
| -rw-r--r-- | security/commoncap.c | 13 |
1 files changed, 4 insertions, 9 deletions
diff --git a/security/commoncap.c b/security/commoncap.c index f20e984ccfb..a93b3b73307 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -529,15 +529,10 @@ skip: new->suid = new->fsuid = new->euid; new->sgid = new->fsgid = new->egid; - /* For init, we want to retain the capabilities set in the initial - * task. Thus we skip the usual capability rules - */ - if (!is_global_init(current)) { - if (effective) - new->cap_effective = new->cap_permitted; - else - cap_clear(new->cap_effective); - } + if (effective) + new->cap_effective = new->cap_permitted; + else + cap_clear(new->cap_effective); bprm->cap_effective = effective; /* |