Commit 4bf2ea77 authored Apr 01, 2011 by Eric Paris Committed by James Morris Apr 04, 2011

capabilities: do not special case exec of init



When the global init task is exec'd we have special case logic to make sure
the pE is not reduced.  There is no reason for this.  If init wants to drop
it's pE is should be allowed to do so.  Remove this special logic.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: David Howells <dhowells@redhat.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: James Morris <jmorris@namei.org>

parent 17f60a7d

security/commoncap.c

+4 −9

Original line number	Diff line number	Diff line
		@@ -529,15 +529,10 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
		new->suid = new->fsuid = new->euid;
		new->sgid = new->fsgid = new->egid;

		/* For init, we want to retain the capabilities set in the initial
		* task. Thus we skip the usual capability rules
		*/
		if (!is_global_init(current)) {
		if (effective)
		new->cap_effective = new->cap_permitted;
		else
		cap_clear(new->cap_effective);
		}
		bprm->cap_effective = effective;

		/*