seccomp: always propagate NO_NEW_PRIVS on tsync

Browse source

commit 103502a35c upstream.

Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Jann Horn 2015-12-26 06:00:48 +01:00 • committed by Greg Kroah-Hartman

parent 0ac4a2a8ba

commit df86161e44

1 changed files with 11 additions and 11 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

kernel/seccomp.c

View file