summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--security/commoncap.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index 0cf4b53480a7..0ecf4ba321cb 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -505,6 +505,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
}
skip:
+ /* if we have fs caps, clear dangerous personality flags */
+ if (!cap_issubset(new->cap_permitted, old->cap_permitted))
+ bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+
/* Don't let someone trace a set[ug]id/setpcap binary with the revised
* credentials unless they have the appropriate permit
*/