[PATCH -mm] capabilities: reset current->pdeath_signal when increasing capabilities

["Serge E. Hallyn" <serge@hallyn.com>]

I think the following does the right thing with respect to the
pdeath_signal bug and file capabilities.  I somewhat question the need
to do this if we're just switching uid or gid (if running in strict
capability mode), but it seems prudent to just leave it right there.

Note that so far this is only need in -mm.  Linus' tree will do the
right thing with the original pdeath patch since the only way to
increase capabilities is to first become root or run a setuid root
binary.

thanks,
-serge

>From 7e21df941dfb55c4fc19d82a91d6eae74766a2ec Mon Sep 17 00:00:00 2001
From: Serge E. Hallyn <serue@us.ibm.com>
Date: Tue, 28 Aug 2007 14:32:35 -0400
Subject: [PATCH] capabilities: reset current->pdeath_signal when increasing capabilities

If running a program which has file capabilities which are not a subset
of the capabilities of the current task, reset pdeath_signal = 0 to
prevent the task parent from (deliberately) signaling a more privileged
app.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
---
 security/commoncap.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/security/commoncap.c b/security/commoncap.c
index d65ddd3..43f9027 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -315,6 +315,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 	if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
 	    !cap_issubset (new_permitted, current->cap_permitted)) {
 		set_dumpable(current->mm, suid_dumpable);
+		current->pdeath_signal = 0;
 
 		if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
 			if (!capable(CAP_SETUID)) {
-- 
1.5.1.1.GIT

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/