diff options
| author | Kees Cook <keescook@chromium.org> | 2017-07-19 00:25:36 +0200 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2017-08-01 21:03:14 +0200 |
| commit | fe8993b3a05cbba6318a54e0f85901aaea6fc244 (patch) | |
| tree | 34631e3a10ab98444573ce343c170d26a6211a04 /fs/exec.c | |
| parent | exec: Use sane stack rlimit under secureexec (diff) | |
| download | linux-fe8993b3a05cbba6318a54e0f85901aaea6fc244.tar.xz linux-fe8993b3a05cbba6318a54e0f85901aaea6fc244.zip | |
exec: Consolidate pdeath_signal clearing
Instead of an additional secureexec check for pdeath_signal, just move it
up into the initial secureexec test. Neither perf nor arch code touches
pdeath_signal, so the relocation shouldn't change anything.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge@hallyn.com>
Diffstat (limited to 'fs/exec.c')
| -rw-r--r-- | fs/exec.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/fs/exec.c b/fs/exec.c index 3235cbd85efa..01a9fb9d8ac3 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1351,6 +1351,9 @@ void setup_new_exec(struct linux_binprm * bprm) bprm->secureexec |= bprm->cap_elevated; if (bprm->secureexec) { + /* Make sure parent cannot signal privileged process. */ + current->pdeath_signal = 0; + /* * For secureexec, reset the stack limit to sane default to * avoid bad behavior from the prior rlimits. This has to @@ -1383,10 +1386,6 @@ void setup_new_exec(struct linux_binprm * bprm) */ current->mm->task_size = TASK_SIZE; - if (bprm->secureexec) { - current->pdeath_signal = 0; - } - /* An exec changes our domain. We are no longer part of the thread group */ current->self_exec_id++; |