From: Eric Paris <eparis@redhat.com>
Date: Fri, 1 Apr 2011 21:08:28 +0000 (-0400)
Subject: capabilities: do not special case exec of init
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=4bf2ea77dba76a22f49db3c10773896aaeeb8f66;p=GitHub%2FLineageOS%2Fandroid_kernel_samsung_universal7580.git

capabilities: do not special case exec of init

When the global init task is exec'd we have special case logic to make sure
the pE is not reduced.  There is no reason for this.  If init wants to drop
it's pE is should be allowed to do so.  Remove this special logic.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: David Howells <dhowells@redhat.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: James Morris <jmorris@namei.org>
---

diff --git a/security/commoncap.c b/security/commoncap.c
index f20e984ccfb..a93b3b73307 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -529,15 +529,10 @@ skip:
 	new->suid = new->fsuid = new->euid;
 	new->sgid = new->fsgid = new->egid;
 
-	/* For init, we want to retain the capabilities set in the initial
-	 * task.  Thus we skip the usual capability rules
-	 */
-	if (!is_global_init(current)) {
-		if (effective)
-			new->cap_effective = new->cap_permitted;
-		else
-			cap_clear(new->cap_effective);
-	}
+	if (effective)
+		new->cap_effective = new->cap_permitted;
+	else
+		cap_clear(new->cap_effective);
 	bprm->cap_effective = effective;
 
 	/*