Messages in this thread | | | From | Linus Torvalds <> | Date | Tue, 19 May 2020 11:28:14 -0700 | Subject | Re: [PATCH v2 1/8] exec: Teach prepare_exec_creds how exec treats uids & gids |
| |
On Tue, May 19, 2020 at 11:03 AM Kees Cook <keescook@chromium.org> wrote: > > One question, though: why add this, since the repeat calling of the caps > LSM hook will do this?
I assume it's for the "preserve_creds" case where we don't even end up setting creds at all.
Yeah, at some point we'll hit a bprm handler that doesn't set 'preserve_creds', and it all does get set in the end, but that's not statically all that obvious.
I think it makes sense to initialize as much as possible from the generic code, and rely as little as possible on what the binfmt handlers end up actually doing.
Linus
| |