diff options
| author | Justin Suess <utilityemal77@gmail.com> | 2026-08-09 11:45:19 -0400 |
|---|---|---|
| committer | Mickaël Salaün <mic@digikod.net> | 2026-08-15 09:14:46 +0200 |
| commit | c2fe8b60b8e414af48a9c09f196ef99baf09afa4 (patch) | |
| tree | 97221e88a85a07df9d820936284c868cc37f6274 /tools/perf/scripts/python/bin/stackcollapse-record | |
| parent | bfff8bec73106336c422783298ec189d81234045 (diff) | |
landlock: Check landlock_restrict_self(2)'s flags before privileges
landlock_restrict_self(2) currently checks the no_new_privs /
CAP_SYS_ADMIN requirement before validating the flags argument. An
unprivileged caller without no_new_privs thus gets EPERM even when the
passed flags are invalid, hiding the EINVAL error.
Move the no_new_privs / CAP_SYS_ADMIN check just after the flags check
so that malformed calls consistently error out with EINVAL whatever the
caller's privileges, the same way seccomp(2) validates its flags before
checking no_new_privs.
Update the restrict_self_checks_ordering test accordingly.
Cc: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
Link: https://patch.msgid.link/20260809154544.1253100-2-utilityemal77@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-record')
0 files changed, 0 insertions, 0 deletions