On Mon, Jul 31, 2017 at 4:51 PM, Kees Cook [off-list ref] wrote:

Instead of a separate function, open-code the cap_elevated test, which
lets us entirely remove bprm->cap_effective (to use the local "effective"
variable instead), and more accurately examine euid/egid changes via the
existing local "is_setid".

The following LTP tests were run to validate the changes:

        # ./runltp -f syscalls -s cap
        # ./runltp -f securebits
        # ./runltp -f cap_bounds
        # ./runltp -f filecaps

All kernel selftests for capabilities and exec continue to pass as well.

Cc: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Kees Cook <redacted>
Reviewed-by: James Morris <redacted>
Acked-by: Serge Hallyn <serge@hallyn.com>

Reviewed-by: Andy Lutomirski <luto@kernel.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html