From: Paul Moore <pmoore@redhat.com>
Date: Thu, 15 May 2014 15:16:06 +0000 (-0400)
Subject: selinux: reject setexeccon() on MNT_NOSUID applications with -EACCES
X-Git-Tag: omap-for-v3.16/fixes-against-rc1~70^2~3
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5b589d44fad18228f18749360d008d5c8ff3aaf8;p=pandora-kernel.git

selinux: reject setexeccon() on MNT_NOSUID applications with -EACCES

We presently prevent processes from using setexecon() to set the
security label of exec()'d processes when NO_NEW_PRIVS is enabled by
returning an error; however, we silently ignore setexeccon() when
exec()'ing from a nosuid mounted filesystem.  This patch makes things
a bit more consistent by returning an error in the setexeccon()/nosuid
case.

Signed-off-by: Paul Moore <pmoore@redhat.com>
Acked-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
---

Reading git-diff-tree failed