aboutsummaryrefslogtreecommitdiff
path: root/security/commoncap.c
diff options
context:
space:
mode:
authorJames Morris <james.l.morris@oracle.com>2012-05-04 12:46:40 +1000
committerJames Morris <james.l.morris@oracle.com>2012-05-04 12:46:40 +1000
commit898bfc1d46bd76f8ea2a0fbd239dd2073efe2aa3 (patch)
treee6e666085abe674dbf6292555961fe0a0f2e2d2f /security/commoncap.c
parent08162e6a23d476544adfe1164afe9ea8b34ab859 (diff)
parent69964ea4c7b68c9399f7977aa5b9aa6539a6a98a (diff)
Merge tag 'v3.4-rc5' into next
Linux 3.4-rc5 Merge to pull in prerequisite change for Smack: 86812bb0de1a3758dc6c7aa01a763158a7c0638a Requested by Casey.
Diffstat (limited to 'security/commoncap.c')
-rw-r--r--security/commoncap.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index edd3918fac0..f80d1160939 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -29,6 +29,7 @@
#include <linux/securebits.h>
#include <linux/user_namespace.h>
#include <linux/binfmts.h>
+#include <linux/personality.h>
/*
* If a non-root user executes a setuid-root binary in
@@ -505,6 +506,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
}
skip:
+ /* if we have fs caps, clear dangerous personality flags */
+ if (!cap_issubset(new->cap_permitted, old->cap_permitted))
+ bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+
/* Don't let someone trace a set[ug]id/setpcap binary with the revised
* credentials unless they have the appropriate permit.
*