projects / cascardo / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 607259e) | patch
seccomp: always propagate NO_NEW_PRIVS on tsync
authorJann Horn <jann@thejh.net>
Sat, 26 Dec 2015 05:00:48 +0000 (06:00 +0100)
committerKees Cook <keescook@chromium.org>
Wed, 27 Jan 2016 15:38:25 +0000 (07:38 -0800)
commit103502a35cfce0710909da874f092cb44823ca03
tree81f6474629fba8af0fc696d5944711f312e04fa0tree | snapshot
parent607259e17b37017e9ec0249a8b0a7d8b76b572aacommit | diff
seccomp: always propagate NO_NEW_PRIVS on tsync

Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: Jann Horn <jann@thejh.net>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
kernel/seccomp.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.