diff options
| author | Dave Airlie <airlied@redhat.com> | 2012-05-07 16:09:09 +0100 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2012-05-07 16:09:35 +0100 |
| commit | 4f256e8aa3eda15c11c3cec3ec5336e1fc579cbd (patch) | |
| tree | 33c02b5e18e79756005a3edfa7c862a47de668d5 /security/commoncap.c | |
| parent | 4086b1e2b19729eebf632073b9d4ab811726d8eb (diff) | |
| parent | dc257cf154be708ecc47b8b89c12ad8cd2cc35e4 (diff) | |
Merge branch 'for-airlied' of git://people.freedesktop.org/~danvet/drm-intel into drm-core-next
Daniel prepared this branch with a back-merge as git was getting
very confused about changes in intel_display.c
Diffstat (limited to 'security/commoncap.c')
| -rw-r--r-- | security/commoncap.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c index 0cf4b53480a..71a166a0597 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -29,6 +29,7 @@ #include <linux/securebits.h> #include <linux/user_namespace.h> #include <linux/binfmts.h> +#include <linux/personality.h> /* * If a non-root user executes a setuid-root binary in @@ -505,6 +506,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) } skip: + /* if we have fs caps, clear dangerous personality flags */ + if (!cap_issubset(new->cap_permitted, old->cap_permitted)) + bprm->per_clear |= PER_CLEAR_ON_SETID; + + /* Don't let someone trace a set[ug]id/setpcap binary with the revised * credentials unless they have the appropriate permit */ |