The patch titled
file capabilities: honor !SECURE_NOROOT
has been removed from the -mm tree. Its filename was
file-capabilities-honor-secure_noroot.patch
This patch was dropped because it was folded into implement-file-posix-capabilities.patch
------------------------------------------------------
Subject: file capabilities: honor !SECURE_NOROOT
From: Serge E. Hallyn <serue@xxxxxxxxxx>
When the SECURE_NOROOT securebit is not set, allow root to keep it's
capabilities over exec, rather than compute the capabilities based on file
capabilities.
Signed-off-by: Serge E. Hallyn <serue@xxxxxxxxxx>
Cc: Stephen Smalley <sds@xxxxxxxxxxxxx>
Cc: James Morris <jmorris@xxxxxxxxx>
Cc: Chris Wright <chrisw@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
security/commoncap.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff -puN security/commoncap.c~file-capabilities-honor-secure_noroot security/commoncap.c
--- a/security/commoncap.c~file-capabilities-honor-secure_noroot
+++ a/security/commoncap.c
@@ -202,12 +202,16 @@ static inline int set_file_caps(struct l
int cap_bprm_set_security (struct linux_binprm *bprm)
{
+ int ret;
+
/* Copied from fs/exec.c:prepare_binprm. */
cap_clear (bprm->cap_inheritable);
cap_clear (bprm->cap_permitted);
cap_clear (bprm->cap_effective);
+ ret = set_file_caps(bprm);
+
/* To support inheritance of root-permissions and suid-root
* executables under compatibility mode, we raise all three
* capability sets for the file.
@@ -225,7 +229,7 @@ int cap_bprm_set_security (struct linux_
cap_set_full (bprm->cap_effective);
}
- return set_file_caps(bprm);
+ return ret;
}
void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
_
Patches currently in -mm which might be from serue@xxxxxxxxxx are
implement-file-posix-capabilities.patch
file-capabilities-honor-secure_noroot.patch
merge-sys_clone-sys_unshare-nsproxy-and-namespace.patch
merge-sys_clone-sys_unshare-nsproxy-and-namespace-fix.patch
merge-sys_clone-sys_unshare-nsproxy-and-namespace-fix-2.patch
integrity-service-api-and-dummy-provider-fix.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
