On Thu, Jan 17, 2019 at 08:12:50AM -0800, Kees Cook wrote: > On Wed, Jan 16, 2019 at 5:26 PM shuah <shuah@xxxxxxxxxx> wrote: > > I am running Linux 5.0-rc2 and not an older kernel. > > Weird. I couldn't reproduce this on 5.0-rc2, but I did see it on a > kernel without seccomp user_notif. Does the patch I sent fix it for > you? (And if so, can you take it in your tree?) I can reproduce it; you have to run it as non-root. I think your patch is necessary to get it to at least fail. The question is: what should we do about these tests that require real root? Skip them if we're not real-root, I guess? Tycho
