I think the following does the right thing with respect to the
pdeath_signal bug and file capabilities. I somewhat question the need
to do this if we're just switching uid or gid (if running in strict
capability mode), but it seems prudent to just leave it right there.
Note that so far this is only need in -mm. Linus' tree will do the
right thing with the original pdeath patch since the only way to
increase capabilities is to first become root or run a setuid root
binary.
thanks,
-serge
>From 7e21df941dfb55c4fc19d82a91d6eae74766a2ec Mon Sep 17 00:00:00 2001
From: Serge E. Hallyn <[EMAIL PROTECTED]>
Date: Tue, 28 Aug 2007 14:32:35 -0400
Subject: [PATCH] capabilities: reset current->pdeath_signal when increasing
capabilities
If running a program which has file capabilities which are not a subset
of the capabilities of the current task, reset pdeath_signal = 0 to
prevent the task parent from (deliberately) signaling a more privileged
app.
Signed-off-by: Serge E. Hallyn <[EMAIL PROTECTED]>
---
security/commoncap.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/security/commoncap.c b/security/commoncap.c
index d65ddd3..43f9027 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -315,6 +315,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int
unsafe)
if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
!cap_issubset (new_permitted, current->cap_permitted)) {
set_dumpable(current->mm, suid_dumpable);
+ current->pdeath_signal = 0;
if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
if (!capable(CAP_SETUID)) {
--
1.5.1.1.GIT
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
