The patch titled
file capabilities: honor !SECURE_NOROOT
has been added to the -mm tree. Its filename is
file-capabilities-honor-secure_noroot.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: file capabilities: honor !SECURE_NOROOT
From: Serge E. Hallyn <serue@xxxxxxxxxx>
When the SECURE_NOROOT securebit is not set, allow root to keep it's
capabilities over exec, rather than compute the capabilities based on file
capabilities.
Signed-off-by: Serge E. Hallyn <serue@xxxxxxxxxx>
Cc: Stephen Smalley <sds@xxxxxxxxxxxxx>
Cc: James Morris <jmorris@xxxxxxxxx>
Cc: Chris Wright <chrisw@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
security/commoncap.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff -puN security/commoncap.c~file-capabilities-honor-secure_noroot security/commoncap.c
--- a/security/commoncap.c~file-capabilities-honor-secure_noroot
+++ a/security/commoncap.c
@@ -202,12 +202,16 @@ static inline int set_file_caps(struct l
int cap_bprm_set_security (struct linux_binprm *bprm)
{
+ int ret;
+
/* Copied from fs/exec.c:prepare_binprm. */
cap_clear (bprm->cap_inheritable);
cap_clear (bprm->cap_permitted);
cap_clear (bprm->cap_effective);
+ ret = set_file_caps(bprm);
+
/* To support inheritance of root-permissions and suid-root
* executables under compatibility mode, we raise all three
* capability sets for the file.
@@ -225,7 +229,7 @@ int cap_bprm_set_security (struct linux_
cap_set_full (bprm->cap_effective);
}
- return set_file_caps(bprm);
+ return ret;
}
void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
_
Patches currently in -mm which might be from serue@xxxxxxxxxx are
implement-file-posix-capabilities.patch
file-capabilities-dont-do-file-caps-if-mnt_nosuid.patch
file-capabilities-honor-secure_noroot.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
