tree 6f894bd8d913009ba8ee3739e5c113b030e4b10b
parent 6a8aa6ba8bfec89ad16f964e42ac11d905ad7a1c
author Jann Horn <jann@thejh.net> 1451106048 +0100
committer Kees Cook <keescook@google.com> 1460148578 +0000

UPSTREAM: seccomp: always propagate NO_NEW_PRIVS on tsync

Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: Jann Horn <jann@thejh.net>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>

Bug: 27892194
Patchset: seccomp

(cherry picked from commit 103502a35cfce0710909da874f092cb44823ca03)
Signed-off-by: Kees Cook <keescook@google.com>
Change-Id: I5a7290daff95794a1d67e0e7f5659a7ca8bfe91c