]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 607259e) | patch
seccomp: always propagate NO_NEW_PRIVS on tsync
authorJann Horn <jann@thejh.net>
Sat, 26 Dec 2015 05:00:48 +0000 (06:00 +0100)
committerKees Cook <keescook@chromium.org>
Wed, 27 Jan 2016 15:38:25 +0000 (07:38 -0800)
commit103502a35cfce0710909da874f092cb44823ca03
tree81f6474629fba8af0fc696d5944711f312e04fa0tree | snapshot
parent607259e17b37017e9ec0249a8b0a7d8b76b572aacommit | diff
seccomp: always propagate NO_NEW_PRIVS on tsync

Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: Jann Horn <jann@thejh.net>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
kernel/seccomp.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git