diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2012-07-08 02:21:59 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-07-08 02:21:59 +0200 |
| commit | a0127afbed65b7b9f8a486c557017eafb4d4c0fc (patch) | |
| tree | 13cc11b0eb15128270e323c4053922d39a7343c7 | |
| parent | vfs: make O_PATH file descriptors usable for 'fchdir()' (diff) | |
| parent | security: Minor improvements to no_new_privs documentation (diff) | |
| download | linux-a0127afbed65b7b9f8a486c557017eafb4d4c0fc.tar.xz linux-a0127afbed65b7b9f8a486c557017eafb4d4c0fc.zip | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull security docs update from James Morris.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
security: Minor improvements to no_new_privs documentation
| -rw-r--r-- | Documentation/prctl/no_new_privs.txt | 7 | ||||
| -rw-r--r-- | include/linux/prctl.h | 2 |
2 files changed, 9 insertions, 0 deletions
diff --git a/Documentation/prctl/no_new_privs.txt b/Documentation/prctl/no_new_privs.txt index cb705ec69abe..f7be84fba910 100644 --- a/Documentation/prctl/no_new_privs.txt +++ b/Documentation/prctl/no_new_privs.txt @@ -25,6 +25,13 @@ bits will no longer change the uid or gid; file capabilities will not add to the permitted set, and LSMs will not relax constraints after execve. +To set no_new_privs, use prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0). + +Be careful, though: LSMs might also not tighten constraints on exec +in no_new_privs mode. (This means that setting up a general-purpose +service launcher to set no_new_privs before execing daemons may +interfere with LSM-based sandboxing.) + Note that no_new_privs does not prevent privilege changes that do not involve execve. An appropriately privileged task can still call setuid(2) and receive SCM_RIGHTS datagrams. diff --git a/include/linux/prctl.h b/include/linux/prctl.h index 3988012255dc..289760f424aa 100644 --- a/include/linux/prctl.h +++ b/include/linux/prctl.h @@ -141,6 +141,8 @@ * Changing LSM security domain is considered a new privilege. So, for example, * asking selinux for a specific new context (e.g. with runcon) will result * in execve returning -EPERM. + * + * See Documentation/prctl/no_new_privs.txt for more details. */ #define PR_SET_NO_NEW_PRIVS 38 #define PR_GET_NO_NEW_PRIVS 39 |