| commit | 746bf6d64275be0c65b0631d8a72b16f1454cfa1 | [log] [tgz] |
|---|---|---|
| author | Andy Lutomirski <[email protected]> | Fri Sep 04 15:42:51 2015 -0700 |
| committer | Linus Torvalds <[email protected]> | Fri Sep 04 16:54:41 2015 -0700 |
| tree | 5debc8e6f0207fdea53271f631f37e319d39fff4 | |
| parent | 32ae976ed3b5ba39c9208ace41bcdf4157d21db3 [diff] |
capabilities: add a securebit to disable PR_CAP_AMBIENT_RAISE Per Andrew Morgan's request, add a securebit to allow admins to disable PR_CAP_AMBIENT_RAISE. This securebit will prevent processes from adding capabilities to their ambient set. For simplicity, this disables PR_CAP_AMBIENT_RAISE entirely rather than just disabling setting previously cleared bits. Signed-off-by: Andy Lutomirski <[email protected]> Acked-by: Andrew G. Morgan <[email protected]> Acked-by: Serge Hallyn <[email protected]> Cc: Kees Cook <[email protected]> Cc: Christoph Lameter <[email protected]> Cc: Serge Hallyn <[email protected]> Cc: Jonathan Corbet <[email protected]> Cc: Aaron Jones <[email protected]> Cc: Ted Ts'o <[email protected]> Cc: Andrew G. Morgan <[email protected]> Cc: Mimi Zohar <[email protected]> Cc: Austin S Hemmelgarn <[email protected]> Cc: Markku Savela <[email protected]> Cc: Jarkko Sakkinen <[email protected]> Cc: Michael Kerrisk <[email protected]> Cc: James Morris <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>