diff options
authorLinus Torvalds <>2020-05-27 09:53:25 -0700
committerLinus Torvalds <>2020-05-27 09:53:25 -0700
commit006f38a1c3dcbe237a75e725fe457bd59cb489c4 (patch)
parent444fc5cde64330661bf59944c43844e7d4c2ccd8 (diff)
parenta4ae32c71fe90794127b32d26d7ad795813b502e (diff)
Merge branch 'exec-linus' of git://
Pull execve fix from Eric Biederman: "While working on my exec cleanups I found a bug in exec that winds up miscomputing the ambient credentials during exec. Andy appears to have to been confused as to why credentials are computed for both the script and the interpreter From the original patch description: [3] Linux very confusingly processes both the script and the interpreter if applicable, for reasons that elude me. The results from thinking about a script's file capabilities and/or setuid bits are mostly discarded. The only value in struct cred that gets changed in cap_bprm_set_creds that I could find that might persist between the script and the interpreter was cap_ambient. Which is fixed with this trivial change" * 'exec-linus' of git:// exec: Always set cap_ambient in cap_bprm_set_creds
1 files changed, 1 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index f4ee0ae106b2..0ca31c8bc0b1 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -812,6 +812,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
int ret;
kuid_t root_uid;
+ new->cap_ambient = old->cap_ambient;
if (WARN_ON(!cap_ambient_invariant_ok(old)))
return -EPERM;