From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 18 Apr 2018 19:45:44 +0000 (+0200)
Subject: seccomp: explain why we use setuid rather than @setuid in @privileged
X-Git-Tag: v239~48^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e05ee49b144110b1ecff030cdadc439604152f16;p=thirdparty%2Fsystemd.git

seccomp: explain why we use setuid rather than @setuid in @privileged
---

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 4a02d8c35f3..c433cb90dce 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -632,7 +632,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "setresuid32\0"
                 "setreuid\0"
                 "setreuid32\0"
-                "setuid\0"
+                "setuid\0"      /* We list the explicit system calls here, as @setuid also includes setgid() which is not necessarily privileged */
                 "setuid32\0"
                 "vhangup\0"
         },