Re: [PATCH v4 03/15] binfmt: Introduce secureexec flag

[Kees Cook]

On Mon, Jul 31, 2017 at 4:51 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
> index 3cd98e8bc9dc..6cfd36a27d4e 100644
> --- a/include/linux/binfmts.h
> +++ b/include/linux/binfmts.h
> @@ -34,6 +34,12 @@ struct linux_binprm {
>                 cap_effective:1;/* true if has elevated effective capabilities,
>                                  * false if not; except for init which inherits
>                                  * its parent's caps anyway */
> +               /*
> +                * Set by bprm_set_creds hook to indicate a privilege-gaining
> +                * exec has happened. Used to sanitize execution environment
> +                * and to set AT_SECURE auxv for glibc.
> +                */
> +               secureexec:1;
>  #ifdef __alpha__
>         unsigned int taso:1;
>  #endif

Grrr. git rebase messed me up. (; vs , in variable list.) I will send
a v5 and double-check the per-patch builds. Bleh.

-Kees

-- 
Kees Cook
Pixel Security