Commit e32f8879 authored May 27, 2020 by Eric W. Biederman

Merge commit a4ae32c7 ("exec: Always set cap_ambient in cap_bprm_set_creds")



This is a bug fix and one of two places where I have found that the
result of calling security_bprm_repopulate_creds more than once on
different bprm->files depends on all of the bprm->files not just the
file bprm->file.

I intend to fix both of those cases and then modify the code to
only call security_bprm_repopulate_creds on the final bprm file.

So merge this change in so I hopefully reduce conflicts for others
and I make it possible to build on top of this change.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

parents 01159348 a4ae32c7

security/commoncap.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -812,6 +812,7 @@ int cap_bprm_repopulate_creds(struct linux_binprm *bprm)
		int ret;
		kuid_t root_uid;

		new->cap_ambient = old->cap_ambient;
		if (WARN_ON(!cap_ambient_invariant_ok(old)))
		return -EPERM;

Admin message