linux-kernel - [PATCH] prctl: document PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120920235407.GA3769@www.outflux.net>
Date:	Thu, 20 Sep 2012 16:54:07 -0700
From:	Kees Cook <keescook@...omium.org>
To:	Michael Kerrisk <mtk.manpages@...il.com>
Cc:	linux-man@...r.kernel.org, linux-doc@...r.kernel.org,
	linux-kernel@...r.kernel.org, wad@...omium.org,
	Andy Lutomirski <luto@...capital.net>
Subject: [PATCH] prctl: document PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW_PRIVS

This adds a short description of the no_new_privs bit, as described in
Documentation/prctl/no_new_privs.txt.

Signed-off-by: Kees Cook <keescook@...omium.org>
---
 man2/prctl.2 |   15 +++++++++++++++
 1 files changed, 15 insertions(+), 0 deletions(-)

diff --git a/man2/prctl.2 b/man2/prctl.2
index a44aa32..220c031 100644
--- a/man2/prctl.2
+++ b/man2/prctl.2
@@ -42,6 +42,7 @@
 .\" 2012-04-25 Michael Kerrisk, Document PR_TASK_PERF_EVENTS_DISABLE and
 .\"				PR_TASK_PERF_EVENTS_ENABLE
 .\" 2012-09-20 Kees Cook, update PR_SET_SECCOMP for mode 2
+.\" 2012-09-20 Kees Cook, document PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW_PRIVS
 .\"
 .\" FIXME: Document PR_SET_TIMERSLACK and PR_GET_TIMERSLACK (new in 2.6.28)
 .\"		commit 6976675d94042fbd446231d1bd8b7de71a980ada
@@ -216,6 +217,19 @@ in the buffer pointed to by
 The buffer should allow space for up to 16 bytes;
 the returned string will be null-terminated if it is shorter than that.
 .TP
+.BR PR_SET_NO_NEW_PRIVS " (since Linux 3.5)"
+Set the current process's \fIno_new_privs\fP bit to the value in
+\fIarg2\fP.  With \fIno_new_privs\fP set to 1, execve promises not
+to grant the privilege to do anything that could not have been done
+without the execve call (for example, rendering setuid, setgid, and file
+capabilities non-functional).  When enabled, this value is inherited
+across fork, clone, and execve and cannot be unset.
+.TP
+.BR PR_GET_NO_NEW_PRIVS " (since Linux 3.5)"
+Return the value of the \fIno_new_privs\fP bit for the current process. A
+value of 0 indicates the regular execve behavior. A value of 1 indicates
+execve will operate in the privilege restricting mode described above.
+.TP
 .BR PR_SET_PDEATHSIG " (since Linux 2.1.57)"
 Set the parent process death signal
 of the calling process to \fIarg2\fP (either a signal value
@@ -567,6 +581,7 @@ option.
 On success,
 .BR PR_GET_DUMPABLE ,
 .BR PR_GET_KEEPCAPS ,
+.BR PR_GET_NO_NEW_PRIVS ,
 .BR PR_CAPBSET_READ ,
 .BR PR_GET_TIMING ,
 .BR PR_GET_SECUREBITS ,
-- 
1.7.0.4


-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/