summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorAnton Arapov <anton@redhat.com>2012-05-09 08:48:00 +0200
committerAnton Arapov <anton@redhat.com>2012-05-09 08:48:00 +0200
commitc0e33d8195b424eb29432998c565d09398933d32 (patch)
tree0bca45b5a68691709a11fea3ad78fd6a6cb98c02 /security
parentb4b6116a13633898cf868f2f103c96a90c4c20f8 (diff)
downloadkernel-uprobes-c0e33d8195b424eb29432998c565d09398933d32.tar.gz
kernel-uprobes-c0e33d8195b424eb29432998c565d09398933d32.tar.xz
kernel-uprobes-c0e33d8195b424eb29432998c565d09398933d32.zip
fedora kernel: 5963c7872d2bee76ac20ba1ccd2ffbbfe9eb5f8bv3.3.5-2
Signed-off-by: Anton Arapov <anton@redhat.com>
Diffstat (limited to 'security')
-rw-r--r--security/commoncap.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index 7ce191ea29a..b8d2bb9d3c9 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -28,6 +28,7 @@
#include <linux/prctl.h>
#include <linux/securebits.h>
#include <linux/user_namespace.h>
+#include <linux/personality.h>
/*
* If a non-root user executes a setuid-root binary in
@@ -504,6 +505,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
}
skip:
+ /* if we have fs caps, clear dangerous personality flags */
+ if (!cap_issubset(new->cap_permitted, old->cap_permitted))
+ bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+
/* Don't let someone trace a set[ug]id/setpcap binary with the revised
* credentials unless they have the appropriate permit
*/