ee67ae7ef6
Instead of a separate function, open-code the cap_elevated test, which lets us entirely remove bprm->cap_effective (to use the local "effective" variable instead), and more accurately examine euid/egid changes via the existing local "is_setid". The following LTP tests were run to validate the changes: # ./runltp -f syscalls -s cap # ./runltp -f securebits # ./runltp -f cap_bounds # ./runltp -f filecaps All kernel selftests for capabilities and exec continue to pass as well. Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: James Morris <james.l.morris@oracle.com> Acked-by: Serge Hallyn <serge@hallyn.com> Reviewed-by: Andy Lutomirski <luto@kernel.org> |
||
---|---|---|
.. | ||
apparmor | ||
integrity | ||
keys | ||
loadpin | ||
selinux | ||
smack | ||
tomoyo | ||
yama | ||
Kconfig | ||
Makefile | ||
commoncap.c | ||
device_cgroup.c | ||
inode.c | ||
lsm_audit.c | ||
min_addr.c | ||
security.c |