1 Upstream-Status: Pending
3 diff --git a/docs/capng_lock.3 b/docs/capng_lock.3
4 index 7683119..a070c1e 100644
5 --- a/docs/capng_lock.3
6 +++ b/docs/capng_lock.3
7 @@ -8,12 +8,13 @@ int capng_lock(void);
11 -capng_lock will take steps to prevent children of the current process to regain full privileges if the uid is 0. This should be called while possessing the CAP_SETPCAP capability in the kernel. This function will do the following if permitted by the kernel: Set the NOROOT option on for PR_SET_SECUREBITS, set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS, set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS, and set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS.
12 +capng_lock will take steps to prevent children of the current process from gaining privileges by executing setuid programs. This should be called while possessing the CAP_SETPCAP capability in the kernel.
14 +This function will do the following if permitted by the kernel: If the kernel supports PR_SET_NO_NEW_PRIVS, it will use it. Otherwise it will set the NOROOT option on for PR_SET_SECUREBITS, set the NOROOT_LOCKED option to on for PR_SET_SECUREBITS, set the PR_NO_SETUID_FIXUP option on for PR_SET_SECUREBITS, and set the PR_NO_SETUID_FIXUP_LOCKED option on for PR_SET_SECUREBITS. If both fail, it will return an error.
18 -This returns 0 on success and a negative number on failure. -1 means a failure setting any of the PR_SET_SECUREBITS options.
19 +This returns 0 on success and a negative number on failure. -1 means a failure to use PR_SET_NO_NEW_PRIVS and a failure setting any of the PR_SET_SECUREBITS options.
23 diff --git a/src/cap-ng.c b/src/cap-ng.c
24 index bd105ba..422f2bc 100644
28 * 2.6.24 kernel XATTR_NAME_CAPS
29 * 2.6.25 kernel PR_CAPBSET_DROP, CAPABILITY_VERSION_2
30 * 2.6.26 kernel PR_SET_SECUREBITS, SECURE_*_LOCKED, VERSION_3
31 + * 3.5 kernel PR_SET_NO_NEW_PRIVS
34 /* External syscall prototypes */
35 @@ -122,6 +123,14 @@ extern int capget(cap_user_header_t header, const cap_user_data_t data);
36 #define SECURE_NO_SETUID_FIXUP_LOCKED 3 /* make bit-2 immutable */
39 +/* prctl values that we use */
40 +#ifndef PR_SET_SECUREBITS
41 +#define PR_SET_SECUREBITS 28
43 +#ifndef PR_SET_NO_NEW_PRIVS
44 +#define PR_SET_NO_NEW_PRIVS 38
47 // States: new, allocated, initted, updated, applied
48 typedef enum { CAPNG_NEW, CAPNG_ERROR, CAPNG_ALLOCATED, CAPNG_INIT,
49 CAPNG_UPDATED, CAPNG_APPLIED } capng_states_t;
50 @@ -663,15 +672,22 @@ int capng_change_id(int uid, int gid, capng_flags_t flag)
54 -#ifdef PR_SET_SECUREBITS
55 - int rc = prctl(PR_SET_SECUREBITS,
56 - 1 << SECURE_NOROOT |
57 - 1 << SECURE_NOROOT_LOCKED |
58 - 1 << SECURE_NO_SETUID_FIXUP |
59 - 1 << SECURE_NO_SETUID_FIXUP_LOCKED, 0, 0, 0);
62 + // On Linux 3.5 and up, we can directly prevent ourselves and
63 + // our descendents from gaining privileges.
64 + if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == 0)
67 + // This kernel is too old or otherwise doesn't support
68 + // PR_SET_NO_NEW_PRIVS. Fall back to using securebits.
69 + rc = prctl(PR_SET_SECUREBITS,
70 + 1 << SECURE_NOROOT |
71 + 1 << SECURE_NOROOT_LOCKED |
72 + 1 << SECURE_NO_SETUID_FIXUP |
73 + 1 << SECURE_NO_SETUID_FIXUP_LOCKED, 0, 0, 0);