]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e22c0af) | patch
seccomp: always propagate NO_NEW_PRIVS on tsync
authorJann Horn <jann@thejh.net>
Sat, 26 Dec 2015 05:00:48 +0000 (06:00 +0100)
committerKees Cook <keescook@chromium.org>
Wed, 27 Jan 2016 15:38:25 +0000 (07:38 -0800)
commit90f6f1283b22977ec92f55c645d23978d1e6d588
tree81f6474629fba8af0fc696d5944711f312e04fa0tree | snapshot
parente22c0afadcab4dcfa5a16147dca01b8ee9c5b231commit | diff
seccomp: always propagate NO_NEW_PRIVS on tsync

Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: Jann Horn <jann@thejh.net>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
kernel/seccomp.c diff | blob | history
Linux Kernel Source Tree.