aboutsummaryrefslogtreecommitdiff
path: root/include/linux/fs_struct.h
diff options
context:
space:
mode:
authorHugh Dickins <hugh@veritas.com>2009-03-28 23:21:27 +0000
committerLinus Torvalds <torvalds@linux-foundation.org>2009-03-28 17:30:00 -0700
commit7c2c7d993044cddc5010f6f429b100c63bc7dffb (patch)
treeb92a6daf7c11f9a53de6fed07512fe02cd5b4a68 /include/linux/fs_struct.h
parente426b64c412aaa3e9eb3e4b261dc5be0d5a83e78 (diff)
downloadvexpress-lsk-7c2c7d993044cddc5010f6f429b100c63bc7dffb.tar.gz
fix setuid sometimes wouldn't
check_unsafe_exec() also notes whether the fs_struct is being shared by more threads than will get killed by the exec, and if so sets LSM_UNSAFE_SHARE to make bprm_set_creds() careful about euid. But /proc/<pid>/cwd and /proc/<pid>/root lookups make transient use of get_fs_struct(), which also raises that sharing count. This might occasionally cause a setuid program not to change euid, in the same way as happened with files->count (check_unsafe_exec also looks at sighand->count, but /proc doesn't raise that one). We'd prefer exec not to unshare fs_struct: so fix this in procfs, replacing get_fs_struct() by get_fs_path(), which does path_get while still holding task_lock, instead of raising fs->count. Signed-off-by: Hugh Dickins <hugh@veritas.com> Cc: stable@kernel.org ___ fs/proc/base.c | 50 +++++++++++++++-------------------------------- 1 file changed, 16 insertions(+), 34 deletions(-) Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux/fs_struct.h')
0 files changed, 0 insertions, 0 deletions