UPSTREAM: seccomp: always propagate NO_NEW_PRIVS on tsync
Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.
Signed-off-by: Jann Horn <[email protected]>
Cc: [email protected]
Signed-off-by: Kees Cook <[email protected]>
Bug: 28020023
Patchset: seccomp
(cherry picked from commit 103502a35cfce0710909da874f092cb44823ca03)
Signed-off-by: Kees Cook <[email protected]>
Change-Id: Ie7cd72d68d72699d4923b665f1d0af55e7ac5024
1 file changed
