Quoting Eric Paris ([EMAIL PROTECTED]):
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 8bb95ed..534abb5 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -8,6 +8,7 @@
> */
>
> #include <linux/capability.h>
> +#include <linux/audit.h>
> #include <linux/module.h>
> #include <linux/init.h>
> #include <linux/kernel.h>
> @@ -373,6 +374,9 @@ int cap_bprm_set_security (struct linux_binprm *bprm)
>
> void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
> {
> + kernel_cap_t pP = current->cap_permitted;
> + kernel_cap_t pE = current->cap_effective;
> +
> if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
> !cap_issubset(bprm->cap_post_exec_permitted,
> current->cap_permitted)) {
> @@ -407,6 +411,12 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm,
> int unsafe)
> }
>
> /* AUD: Audit candidate if current->cap_effective is set */
> + if (!cap_isclear(current->cap_effective)) {
> + if (!cap_issubset(current->cap_effective, CAP_FULL_SET) ||
Hi Eric,
can you explain what the cap_issubset() check is for here?
thanks,
-serge
> + (bprm->e_uid != 0) || (current->uid != 0) ||
> + issecure(SECURE_NOROOT))
> + audit_log_bprm_fcaps(bprm, &pP, &pE);
> + }
>
> current->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
> }
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
