summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorAndrew G. Morgan <morgan@kernel.org>2008-07-04 09:59:59 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2008-07-04 10:40:08 -0700
commit1209726ce942047c9fefe7cd427dc36f8e9ded53 (patch)
tree298e78052d6bdd92c78b22c86604f8c8364bc8d9 /security
parent086f7316f0d400806d76323beefae996bb3849b1 (diff)
security: filesystem capabilities: fix CAP_SETPCAP handling
The filesystem capability support meaning for CAP_SETPCAP is less powerful than the non-filesystem capability support. As such, when filesystem capabilities are configured, we should not permit CAP_SETPCAP to 'enhance' the current process through strace manipulation of a child process. Signed-off-by: Andrew G. Morgan <morgan@kernel.org> Acked-by: Serge Hallyn <serue@us.ibm.com> Cc: David Howells <dhowells@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'security')
-rw-r--r--security/commoncap.c13
1 files changed, 10 insertions, 3 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index 5edabc7542a..33d34330841 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -103,10 +103,16 @@ static inline int cap_inh_is_capped(void)
return (cap_capable(current, CAP_SETPCAP) != 0);
}
+static inline int cap_limit_ptraced_target(void) { return 1; }
+
#else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
static inline int cap_block_setpcap(struct task_struct *t) { return 0; }
static inline int cap_inh_is_capped(void) { return 1; }
+static inline int cap_limit_ptraced_target(void)
+{
+ return !capable(CAP_SETPCAP);
+}
#endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
@@ -342,9 +348,10 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
bprm->e_uid = current->uid;
bprm->e_gid = current->gid;
}
- if (!capable (CAP_SETPCAP)) {
- new_permitted = cap_intersect (new_permitted,
- current->cap_permitted);
+ if (cap_limit_ptraced_target()) {
+ new_permitted =
+ cap_intersect(new_permitted,
+ current->cap_permitted);
}
}
}