| commit | 103502a35cfce0710909da874f092cb44823ca03 | [log] [tgz] |
|---|---|---|
| author | Jann Horn <jann@thejh.net> | Sat Dec 26 06:00:48 2015 +0100 |
| committer | Kees Cook <keescook@chromium.org> | Wed Jan 27 07:38:25 2016 -0800 |
| tree | 81f6474629fba8af0fc696d5944711f312e04fa0 | |
| parent | 607259e17b37017e9ec0249a8b0a7d8b76b572aa [diff] |
seccomp: always propagate NO_NEW_PRIVS on tsync Before this patch, a process with some permissive seccomp filter that was applied by root without NO_NEW_PRIVS was able to add more filters to itself without setting NO_NEW_PRIVS by setting the new filter from a throwaway thread with NO_NEW_PRIVS. Signed-off-by: Jann Horn <jann@thejh.net> Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>