diff options
| author | Stefan Richter <stefanr@s5r6.in-berlin.de> | 2012-05-21 21:39:42 +0200 |
|---|---|---|
| committer | Stefan Richter <stefanr@s5r6.in-berlin.de> | 2012-05-21 21:39:42 +0200 |
| commit | 0ad8c6a22d03a1598f7cc6585c65354dadca62ad (patch) | |
| tree | 1507deef3d55d5f3c71b2f76924fe1f6c6211905 /security/commoncap.c | |
| parent | 8527f8e2934683e53405fbe876a4e6f4a0c46eb8 (diff) | |
| parent | 76e10d158efb6d4516018846f60c2ab5501900bc (diff) | |
Merge tag 'v3.4' with SCSI updates, needed for subsequent firewire-sbp2 changes
Linux 3.4
Diffstat (limited to 'security/commoncap.c')
| -rw-r--r-- | security/commoncap.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c index 0cf4b53480a..71a166a0597 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -29,6 +29,7 @@ #include <linux/securebits.h> #include <linux/user_namespace.h> #include <linux/binfmts.h> +#include <linux/personality.h> /* * If a non-root user executes a setuid-root binary in @@ -505,6 +506,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) } skip: + /* if we have fs caps, clear dangerous personality flags */ + if (!cap_issubset(new->cap_permitted, old->cap_permitted)) + bprm->per_clear |= PER_CLEAR_ON_SETID; + + /* Don't let someone trace a set[ug]id/setpcap binary with the revised * credentials unless they have the appropriate permit */ |