lkml.org 
[lkml]   [2006]   [Dec]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH 2/2] file capabilities: honor !SECURE_NOROOT
    From: Serge E. Hallyn <serue@us.ibm.com>
    Subject: [PATCH 2/2] file capabilities: honor !SECURE_NOROOT

    When the SECURE_NOROOT securebit is not set, allow root to
    keep it's capabilities over exec, rather than compute the
    capabilities based on file capabilities.

    Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
    ---
    security/commoncap.c | 6 +++++-
    1 files changed, 5 insertions(+), 1 deletions(-)

    diff --git a/security/commoncap.c b/security/commoncap.c
    index fde9695..be86acb 100644
    --- a/security/commoncap.c
    +++ b/security/commoncap.c
    @@ -202,12 +202,16 @@ #endif

    int cap_bprm_set_security (struct linux_binprm *bprm)
    {
    + int ret;
    +
    /* Copied from fs/exec.c:prepare_binprm. */

    cap_clear (bprm->cap_inheritable);
    cap_clear (bprm->cap_permitted);
    cap_clear (bprm->cap_effective);

    + ret = set_file_caps(bprm);
    +
    /* To support inheritance of root-permissions and suid-root
    * executables under compatibility mode, we raise all three
    * capability sets for the file.
    @@ -225,7 +229,7 @@ int cap_bprm_set_security (struct linux_
    cap_set_full (bprm->cap_effective);
    }

    - return set_file_caps(bprm);
    + return ret;
    }

    void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
    --
    1.4.1
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-12-08 20:41    [W:0.020 / U:29.924 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site