tree 81f6474629fba8af0fc696d5944711f312e04fa0
parent 607259e17b37017e9ec0249a8b0a7d8b76b572aa
author Jann Horn <jann@thejh.net> 1451106048 +0100
committer Kees Cook <keescook@chromium.org> 1453909105 -0800

seccomp: always propagate NO_NEW_PRIVS on tsync

Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: Jann Horn <jann@thejh.net>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>