From 686d9ba614adfef22b1eedc6d1565e18e8778829 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 23 Jun 2016 01:33:07 +0200 Subject: execute: set PR_SET_NO_NEW_PRIVS also in case the exec memory protection is used This was forgotten when MemoryDenyWriteExecute= was added: we should set NNP in all cases when we set seccomp filters. --- src/core/execute.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/execute.c b/src/core/execute.c index ac87e334a4..135e567222 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -2017,7 +2017,7 @@ static int exec_child( } if (context->no_new_privileges || - (!have_effective_cap(CAP_SYS_ADMIN) && (use_address_families || use_syscall_filter))) + (!have_effective_cap(CAP_SYS_ADMIN) && (use_address_families || context->memory_deny_write_execute || use_syscall_filter))) if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) { *exit_status = EXIT_NO_NEW_PRIVILEGES; return -errno; -- cgit v1.2.3-54-g00ecf