Skip to content
Snippets Groups Projects
Commit 148e21a7 authored by Jann Horn's avatar Jann Horn Committed by Paul Lawrence
Browse files

seccomp: always propagate NO_NEW_PRIVS on tsync


Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: default avatarJann Horn <jann@thejh.net>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>

Bug: 36656103
(cherry-picked from commit 103502a35cfce0710909da874f092cb44823ca03)
Signed-off-by: default avatarPaul Lawrence <paullawrence@google.com>

Change-Id: I5abd7daab9172f1dfd53e11706b7c7f331f2f4f1
parent 816857b1
No related branches found
No related tags found
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment