On Mon, Jul 31, 2017 at 4:51 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
> index 3cd98e8bc9dc..6cfd36a27d4e 100644
> --- a/include/linux/binfmts.h
> +++ b/include/linux/binfmts.h
> @@ -34,6 +34,12 @@ struct linux_binprm {
> cap_effective:1;/* true if has elevated effective capabilities,
> * false if not; except for init which inherits
> * its parent's caps anyway */
> + /*
> + * Set by bprm_set_creds hook to indicate a privilege-gaining
> + * exec has happened. Used to sanitize execution environment
> + * and to set AT_SECURE auxv for glibc.
> + */
> + secureexec:1;
> #ifdef __alpha__
> unsigned int taso:1;
> #endif
Grrr. git rebase messed me up. (; vs , in variable list.) I will send
a v5 and double-check the per-patch builds. Bleh.
-Kees
--
Kees Cook
Pixel Security
