summaryrefslogtreecommitdiff
path: root/fs/compat.c
diff options
context:
space:
mode:
authorHugh Dickins <hugh@veritas.com>2009-03-28 23:20:19 +0000
committerLinus Torvalds <torvalds@linux-foundation.org>2009-03-28 17:30:00 -0700
commite426b64c412aaa3e9eb3e4b261dc5be0d5a83e78 (patch)
treec1528139b34fef3e4595576266c64068098fe211 /fs/compat.c
parent53e9309e01277ec99c38e84e0ca16921287cf470 (diff)
downloadlinux-3.10-e426b64c412aaa3e9eb3e4b261dc5be0d5a83e78.tar.gz
linux-3.10-e426b64c412aaa3e9eb3e4b261dc5be0d5a83e78.tar.bz2
linux-3.10-e426b64c412aaa3e9eb3e4b261dc5be0d5a83e78.zip
fix setuid sometimes doesn't
Joe Malicki reports that setuid sometimes doesn't: very rarely, a setuid root program does not get root euid; and, by the way, they have a health check running lsof every few minutes. Right, check_unsafe_exec() notes whether the files_struct is being shared by more threads than will get killed by the exec, and if so sets LSM_UNSAFE_SHARE to make bprm_set_creds() careful about euid. But /proc/<pid>/fd and /proc/<pid>/fdinfo lookups make transient use of get_files_struct(), which also raises that sharing count. There's a rather simple fix for this: exec's check on files->count has been redundant ever since 2.6.1 made it unshare_files() (except while compat_do_execve() omitted to do so) - just remove that check. [Note to -stable: this patch will not apply before 2.6.29: earlier releases should just remove the files->count line from unsafe_exec().] Reported-by: Joe Malicki <jmalicki@metacarta.com> Narrowed-down-by: Michael Itz <mitz@metacarta.com> Tested-by: Joe Malicki <jmalicki@metacarta.com> Signed-off-by: Hugh Dickins <hugh@veritas.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/compat.c')
-rw-r--r--fs/compat.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/compat.c b/fs/compat.c
index b543363dd62..55efdfebdf5 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1441,7 +1441,7 @@ int compat_do_execve(char * filename,
bprm->cred = prepare_exec_creds();
if (!bprm->cred)
goto out_unlock;
- check_unsafe_exec(bprm, current->files);
+ check_unsafe_exec(bprm);
file = open_exec(filename);
retval = PTR_ERR(file);