linux/security/commoncap.c
<<
>>
Prefs
   1/* Common capabilities, needed by capability.o.
   2 *
   3 *      This program is free software; you can redistribute it and/or modify
   4 *      it under the terms of the GNU General Public License as published by
   5 *      the Free Software Foundation; either version 2 of the License, or
   6 *      (at your option) any later version.
   7 *
   8 */
   9
  10#include <linux/capability.h>
  11#include <linux/audit.h>
  12#include <linux/module.h>
  13#include <linux/init.h>
  14#include <linux/kernel.h>
  15#include <linux/security.h>
  16#include <linux/file.h>
  17#include <linux/mm.h>
  18#include <linux/mman.h>
  19#include <linux/pagemap.h>
  20#include <linux/swap.h>
  21#include <linux/skbuff.h>
  22#include <linux/netlink.h>
  23#include <linux/ptrace.h>
  24#include <linux/xattr.h>
  25#include <linux/hugetlb.h>
  26#include <linux/mount.h>
  27#include <linux/sched.h>
  28#include <linux/prctl.h>
  29#include <linux/securebits.h>
  30#include <linux/user_namespace.h>
  31#include <linux/binfmts.h>
  32#include <linux/personality.h>
  33
  34/*
  35 * If a non-root user executes a setuid-root binary in
  36 * !secure(SECURE_NOROOT) mode, then we raise capabilities.
  37 * However if fE is also set, then the intent is for only
  38 * the file capabilities to be applied, and the setuid-root
  39 * bit is left on either to change the uid (plausible) or
  40 * to get full privilege on a kernel without file capabilities
  41 * support.  So in that case we do not raise capabilities.
  42 *
  43 * Warn if that happens, once per boot.
  44 */
  45static void warn_setuid_and_fcaps_mixed(const char *fname)
  46{
  47         option value=e)2j16" id,924
  
      me="L46">  46{id,924
4.c#L348 id="L47" cl  4(!name="L47">  47         option value=e)2j1) "L46" class="line" name="L46">  46span>
  47>  47KERN_INFO       option vKERN_INFO id=""L44" class="progng">"aluegng: `%s'> * If afca"General Public License as published by
" effectivpport.  So in t T cleif ent"> * sugngan l"General Public License as published by
" ort.  So in t\n"General,lname="L47">  47_mixed(const char *
  
      m5span>
  47         option value=e)2j1 = 16" id,924
  
      m5span>

  
      m5span>

  
      m5/span>
  5)
  47L33_e/linuxuidn        option vL33_e/linuxuidn ass="prouc" name="L47">  47sock       option vsock id="setuid_and_fcapssk       option vsk id=, prouc" name="L47">  47sk_/lin       option vsk_/lin id="setuid_and_fcapsskb       option vskb href="+code=fname" class="sref">fnam5{
  45="L46"> 546{id,924
5.c#L358 id="L47" cltion="a06" id,924
  
      m5span>

  
      m6span>
  6span>
  42 *<6span>

 ort.  So s also set, then the intent is for only<6/span>
<6a href="security/common6.c#L46" id="L35" class="line" name="@r o: T c crt.  So sass="ceck if  also set, then the intent is for only<6/span>
 also set, then the intent is for only<6{
   7 *<6="L46"> 646{id,924
6.c#L36" id="L38" class="line" name="De claity when clat"> noaitats=ntask> also set, then the intent is for only<6span>
    (at your option) any later version.

 bc spad likent"> omment's ort.  f()   (at your option) any later version.

	< t  T a9"> ,4/l   sppssma nics:   (at your option) any later version.

  44 */<7/span>
<7a href="security/common7.c#L47" id=ne" name="L47">  47L33_ort.  f       option vL33_ort.  fass="sref">prouc" name="L47">  47cred       option vLr=e)2j1 setuid_and_fcapscred       option vLr=e)2j1, prouc" name="L47">  47/user_namespac       option v/user_namespac)2j1 setuid_and_fcaps">
	_ns       option v">
	_ns)2j1,44 */<7/span>
  47L33       option vL33)2j1,  e" name="L47">  47"de/l       option v"de/l href="+code=fname" class="sref">fnam7="L46"> 746{id,924
7.c#L378 id="L46" class="line" name="L46">  47span>
  48span>
  44 */<8span>

	_ns       option v">
	_ns)2j1 != &etuid_and_fcapslude_/user_s       option vlude_/user_s)2j1 && name="L47">  47/id_eq       option v/id_eqass="name="L47">  47">
	_ns       option v">
	_ns)2j1-" clname="L47">  47owncl       option vowncl)2j1, etuid_and_fcapscred       option vLr=e)2j1-" clname="L47">  47e/id       option ve/id hreff="+code=fname" class="sref">fnam8span>

  
      m8span>
  8span>
 necmesary ort.  So in ? ="L44">  44 */<8/span>
<8a href="security/common8.c#L485 id="L47" clllllllll  4(etuid_and_fcaps">
	_ns       option v">
	_ns)2j1 == etuid_and_fcapscred       option vLr=e)2j1-" clname="L47">  47/user_s       option v/user_s)2j1f="+code=fname" class="sref">fnam8/span>
<8a href="security/common8.c#L486 id="L47" clllllllll"L47" cltion="aname="L47">  47L33_* sup        option vL33_* sup ass="name="L47">  47cred       option vLr=e)2j1-" clname="L47">  47L33_effectivp       option vL33_effectivp)2j1, etuid_and_fcapsc33       option vL33)2j1) ?a0l: -etuid_and_fcapsEPERM       option vEPERM)2j16" id,924
  
      m8/span>
<8a href="security/common8.c#L487 id="L33" class="line" name="L33">  8/span>
  44 */<8span>

	_ns       option v">
	_ns)2j1 == &etuid_and_fcapslude_/user_s       option vlude_/user_s)2j1f="+code=fname" class="sref">fnam9span>

  
      m9span>
  9span>
  34/*<9span>
  34/*<9span>
  3all ohildrowrspan _namespacsermswell    (at your option) any later version.<9/span>
<9a href="security/common9.c#L49" id="L35" class="line" nameeeeeeeeeeeeeeeee*="L8">   8 */
<9a href="security/common9.c#L496 id="L47" cllllllllletuid_and_fcaps">
	_ns       option v">
	_ns)2j1 =letuid_and_fcaps">
	_ns       option v">
	_ns)2j1-" clname="L47">  47parowe       option v>arowe)2j16" id,924
  
      m9/span>
<9a href="security/common9.c#L49" id="L47" cl}" id,924
  
      m9/span>
<9a href="security/common9.c#L398 id="L33" class="line" name="L33">  9/span>
 ne>  3">   clee*="L8">   8 */<109

  
      m10>>
  10>>
  42 *<10>>
 ourrowevprocmes maypss=e fileystem clock i42">  42 *<10>>
  42 *<10>>
  42 *<10>>
  42 *<10>>
 ourrowevprocmes maypss=e fileystem clock* the imfzonf i42">  42 *<10>>
 *-vpp  4denis=    (at your option) any later version.<10>>
   8 */<1 9
  47L33_settimf       option vL33_settimfass="sref">prouc" name="L47">  47timfepec       option v"imfepec)2j1 setuid_and_fcaps"s       option v"s)2j1, sref">prouc" name="L47">  47timfz
fnam1a>> 41a>> 47ort. f option vL33. fass="name="L47"> 47CAP_SYS_TIME option vCAP_SYS_TIME hreff="+code=fname" class="sref">fnam1a>> m1a>> m1a>> m1a>> 42 *<1a>> ourrowevprocmes maypaccmes"L42"> 42 *<1a>> 42 *<1a>> 42 *<1a>> > 42 *<1a>> smmoasrnms="ncmetsrn/user_s the "L42"> 42 *<1a>> > de/linocrt. So sass=span > n/user_sclommende/lin (at your option) any later version.<1a>> > *-vpp 4denis= (at your option) any later version.<1a>> 8 */<1a>> 47L33_de/lin_accmes_"ceck option vL33_de/lin_accmes_"ceckass="prouc" name="L47"> 47task_prouc" option v">sk_prouc")2j1 setuid_and_fcapschild option vLhild)2j1, unsigned e" name="L47"> 47s="c option vs="c)2j1f="+code=fname" class="sref">fnam1a>> 4133 47re" option vret)2j1 =l06" id,924 m1/span> prouc" name="L47"> 47cred option vLr=e)2j1 setuid_and_fcapscred option vLr=e)2j1, setuid_and_fcapschild_cred option vLhild_cred)2j16" id,924 m1/span> 47rcu_read_lock option vrcu_read_lockass="f6" id,924 m1/span> 47cred option vLr=e)2j1 = etuid_and_fcapscurrowe_cred option vLurrowe_credass="f6" id,924 m1/>> 47child_cred option vLhild_cred)2j1 = etuid_and_fcaps__">sk_cred option v__">sk_credass="name="L47"> 47child option vLhild)2j1f6" id,924 m1/span> 47/user_s option v/user_s)2j1 == etuid_and_fcapschild_cred option vLhild_cred)2j1-" clname="L47"> 47/user_s option v/user_s)2j1 &&" id,924 m1/>> 47L33_iseubse" option vL33_iseubse"ass="name="L47"> 47child_cred option vLhild_cred)2j1-" clname="L47"> 47L33_dclaittp option vL33_dclaittp )2j1, etuid_and_fcapscred option vLr=e)2j1-" clname="L47"> 47L33_dclaittp option vL33_dclaittp )2j1ff="+code=fname" class="sref">fnam1/span> 47ou" option vou")2j16" id,924 m1/span> 47child_cred option vLhild_cred)2j1-" clname="L47"> 47/user_s option v/user_s)2j1, etuid_and_fcapsCAP_SYS_PTRACE option vCAP_SYS_PTRACE)2j1ff="+code=fname" class="sref">fnam1/>> 47ou" option vou")2j16" id,924 m1/span> 47re" option vret)2j1 =l-etuid_and_fcapsEPERM option vEPERM)2j16" id,924 m1e) 47ou" option vou")2j1:" id,924 m1espan> 47rcu_read_unlock option vrcu_read_unlockass="f6" id,924 m1e="L46"> 1 46{id,924 14.c#L148 id="L47" cltion="aname="L47"> 47re" option vret)2j16" id,924 m1e>> m1/span> 1/span> 42 *<15span> ourrowe"L42"> 42 *<15span> 42 *<15span> 42 *<15span> smmoasrnms="ncmetsrn/user_s the 42 *<15) 1546{id,924 15.c#L15" id="L38" class="line" name="mccmes> noaitats=ntask> 3 ourrowe"L42"> 42 *<16span> *-vpp 4denis= (at your option) any later version.<16span> 8 */<16span> 47L33_de/lin_e/linmf option vL33_de/lin_e/linmfass="prouc" name="L47"> 47task_prouc" option v">sk_prouc")2j1 setuid_and_fcapsparowe option v>arowe)2j1f="+code=fname" class="sref">fnam16/span> <16a href="security/common16.c#L16" id="L46" class="line" name="L46"> 416>> 47re" option vret)2j1 =l06" id,924 m16{ prouc" name="L47"> 47cred option vLr=e)2j1 setuid_and_fcapscred option vLr=e)2j1, setuid_and_fcapschild_cred option vLhild_cred)2j16" id,924 m16="L46"> 1646{id,924 16.c#L168 id="L33" class="line" name="L33"> 16span> 47rcu_read_lock option vrcu_read_lockass="f6" id,924 m1/span> 47cred option vLr=e)2j1 = etuid_and_fcapscurrgt; arowe)2j1f="+codd,924 m1/span> 47cred _cred option vLhild_cred)2j1 = etuid_and_fcaps__">owe_cred option vLurrowe_credass="f6" id,924 m1/>&gn> 47/user_s option v/user_s)2j1 == etuid_and_fcapschild_cred option vLhild_cred)2j1-" clname="L47"> 47/user_s option v/user_s)2j1 &&" id,924 m1/>&gn> 47L33_iseubse" option vL33_iseubse"ass="name="L47"> 47child_cred option vLhild_cred)2j1-" clname="L47"> 47L33_dclaittp option vL33_dclaittp )2j1, etuid_and_fcapscred option vLr=e)2j1-" clname="L47"> 47L33_dclaittp option vL33_dclaittp )2j1ff="+code=fname" class="sref">fnam1/span> 47ou" option vou")2j16" id,924 m1/spaan> <7a h1ref="security/common7.c#1L47" 175"L47" cl 4(!namd_and_fcapscredcrt.nt. So s() t option vou")crt.nt. So s() t139 id="L47" clname= option v>arowe)2j1f="+couid_and_fcapscred _cred option vLhild_cred)2j1-" clname="L47"> 47/user_s option v/user_s)2j1, etuid_and_fcapsCAP_SYS_PTRACE option vCAP_SYS_PTRACE)2j1ff="+code=fname" class="sref">fnam1/>&gan> <7a h1ref="security/common7.c#1L47" 17="L47" cllllllllletui=name="L47"> 47ou" option vou")2j16" id,924 m1/spaa; 47rcu_r option vret)2j1 =l-etuid_and_fcapsEPERM option vEPERM)2j16" id,924 m1e 746<1/a>{id,924 7.c#1L378 1d="L46="L47"> 47ou" option vou")2j1:" id,924 m1espan> 47rcu_read_lockck option vrcu_read_unlockass="f6" id,924 m1e="Ln> 47re" option vret)2j16" id,924 m1e>&gn> 42 *<15span> 42 *<15 <8a h1ref="security/common8.c#1L485 18="L35" class="line" name="@tz: T n/usc task>propfromch"comaamere=nal crort. So s alse fi2"> 42 *<15 <7a h1ref="security/common8.c#1L486 18="L36" class="line" name="@ude/ctivp)2j1c procmlt"> omerecor> ort.ctivppss="cti"> 42 *<15 omerecor> ort.inhe="cass="cti"> 42 *<15 omerecor> ort.ittp ass=scti"> 42 *<15 42 *<15 3 42 *<15 8 */<16span> 47L33_ort. fg option vL33_iseu fg "prouc" name="L47"> 47task_prouc" option v">sk_prouc")2j1 setuid_and_fcapsparo sk_prg "prouid_and_fcapsCAP_nt'u f_inp option v">sknt'u f_i setuid_and_fcapsparoctivp option vL33_ctivp)2j1, etua> */<16span> sknt'u f_i setuid_and_fcapsparoinhe="cass=np option v">skinhe="cass="prouid_and_fcapsCAP_nt'u f_inp option v">sknt'u f_i setuid_and_fcapsparoittp option vL33_ittp )2j1ff="+a> */<16spann> <8a h1ref="security/common9.c#1L49" 19="L46" class="line" name="L46"> 416>&gan> <9a h1ref="security/common9.c#1L496 1d="L47" clllll">prouc" name="L47"> 47cred option vLr=e)2j1 setuid_and_fcapscred option vLr=e)2j1, se" class="fref">linux/mman.h>; 8/sp1an> <9a h1ref="security/common9.c#1L398 19="L47" clname=" class="line" name=Do"coe="vaskfromcnt'x/capabilityc:sysu fg L44"> 44 */<8spa1an> 47rcu_read_lock option vrcu_read_lockass="f6" id,924 m1/sp2a> 47cred option vLr=e)2j1 = etuid_and_fcapscurrgt; sk_prg "proid,924 m1/sp2a; 47/usecffectivp option vL33_effectivp)2j1, etd,924 m1/sp2a; skinhe="cass="proeuid_and_fcapscred option vLr=e)2j1-" clname="L47"> 47/usecffeinhe="cass=np option v">skcffeinhe="cass=, etd,924 m1/sp2a; 47/usecffeittp option vL33_dclaittp )2j1ff="d,924 m1/sp2a; 47rcu_read_lockck option vrcu_read_unlockass="f6" id,924 m1e="2t; m1a>&2t; 8/sp2t; 34/*<9spa2t; noaiinhe="cass=" So s alss="ientlip )s=s/linwncll2"> 42 *<1a>&2a> 8 */<1a>&2t; skin/com"L47"name="L47"> 47L33_ort.inh_isu fp option vL33_dclainh_isu fp "f6" ="li+a> */<16sp2 clat"> o2f="security/commoncapp.c27hre12o> *2/a> m12>> *2/a> m1e>> oaitats=ntask optiETP ope" name=="L8"> 8 ort. So s also set, then the intent is 2/a> m12>> 8 8/>> 47L33_ort. f option vL33_orted)2j1 = etuid_and_fcaps__">owe_cred option vLurrowe_cowe)2j1f="+couid_and_fcaps__">owe_cred option vLurrowe_c_cred)2j1-" clname="L47"> 47/user_s option v/us=="L8"> 8/*<9s>> ser_0fp "f6" ="li+a> > 2kbuff.h>> > 42 42newcred: T c cr; al nae="ins shouldopopmadene> e" name=="L42"> 42oaits=ourroi clat">red: T c cre" name=="L42"> 42 8/a>> newc">" effectivpportort.ittp ass=scti"> 42newcn clat"> noaiinhe="cass="rt.ittp ass=scti"> 42newce" name="giinhe="cass="rt.ittp ass=scti"> 42 42m="Lpan classoass=s/linot"> ourrowe"L42"> 42fnam12>> .name=@an clasr=, 4maden"ientliild task>new> ourrowe"L42"> 42 m12span> 8 L33_iseubse" opt> L3333_iseu fg "prouc" name="L47"> 47cred option vLr=e)2j1 setuid_new> 47cred new> /us=="L8"> 8prouc" name="L47"> 47cred option vLr=e)2j1 setuid_o"> 47child otion vL=="L8"> 8 8/span> sknt'u f_i setuid_and_fcapsparoctivp option vL33_ctivp)2j1, etua>sknt'u f_i setuid_and_fcapsparoinhe="cass=np option v">skinhtivp)2j1, etua>sknt'u f_i setuid_and_fcapsparoittp option vL33_ittp )2j1ff="+a>fnam12span> 47L33_ort.inh_isu fp option vL33_dclainh_i)ser_s)2j1 &&" id,924 2/a> m12span> 47L33_iseubse" option vL33_iseu39u f_i setuid_and_fcapsparoinhe="cass=np option v">skinhtivp)2j1, etua> 47child otion vvLr=e)2j1-" clname="L47"> 47/usecffeinhe="cass=np option v">skcffeinhtivp)2j1, etua> 47child otion vvLr=e)2j1-" clname="L47"> 47L33_dclaittp option vL33_dclaitittp )2j1ff="+a>"sa1 merecor> ort.inline" name=="L8"> 8 2/a> m12="L46"> 1 46{id,924<2optio24 16.c#L168 id="L33" class="line" name2/a> m12>> 47L33_iseubse" option vL33_iseu39u f_i setuid_and_fcapsparoinhe="cass=np option v">skinhtivp)2j1, etua> 47child otion vvLr=e)2j1-" clname="L47"> 47/usecffeinhe="cass=np option v">skcffeinhtivp)2j1, etua> 12span> 47child otion vvLr=e)2j1-" clname="L47"7L33_iseubse" optvL33_iseitittp )2j1ff="+a> *<12span> .inline" name=="L8"> 8 *<12span> 2ent"> *<12span> *2ent"> *<12span> 8 47L33_iseubse" option vL33_iseu39u f_i setuid_and_fcapsparoittp option vL33_he="cass="prouid_o"> 47child otion vvLr=e)2j1-" clname="L47"> 47L33_dclaittp option vL33_dclait=="L8"> 8 2ersion.<12="L46"> 1546{id,924<2optio25 16.c#L168 id="L33" class="line" name2ersion.<12>> 8 47L33_iseubse" option vL33_iseu39u f_i setuid_and_fcapsparoctivp option vL33_c#39u f_i setuid_and_fcapsparoittp option vL33_it=="L8"> 8 2ent"> *<12span> 47cred new> /uvLr=e)2j1-" clname="L47"> 47/usecffectivp option vL33_effe ttp 39u f_i setuid_and_fcapsparoctivp option vL33_EPERM)2j16" id,924 2ent"> *<12span> 47/usecffeinhe="cass=np option v">skcffeintp 39u f_i setuid_and_fcapsparoinhe="cass=np option v">skinEPERM)2j16" id,924 2ent"> *<12/span> <16a href="securi2y/com26a1p.c#L145 id="L47" clname="new> 47cred new> /uvLr=e)2j1-" clname="L47"> 47L33_dclaittp option vL33_dcla ttp 39u f_i setuid_and_fcapsparoittp option vL33_EPERM)2j16" id,924 2ea> m12>> m12{ 1646{id,924<2optio2> 16.c#L168 id="L33" class="line" name2"L33"> 12span> 34 m12span> 8su 2d="L47"line" d_bprm_cleart> Lapsparoin/commobprm_cleart> L33_iseu fg "prouc" name="ptiux_b_fprmapsparoin/commoptiux_b_fprmknt'u f_i setuid_bprmapsparoin/commobprmknt&t=="L8"> 8 *2ef">fnam12span> 47L33_dclaittp option vL33_dclail 4(="a06" id,924 m12spaan> <7a h1ref="securi2y/com27a1p.c#L145 id="L47" clname="bprmapsparoin/commobprmknt&vLr=e)2j1-" clname="L47"> 47/usecffectivp option vL33_effe p )2j1ff="ameuid_falsecffectivp falseL33_EPERM)2j16" id,924 2ef">fnam12>&gan> <7a h1ref="securi2y/com27ap06c2Lp." 2d="L36d,924 m12spaa; m12 746<1/a>{id,924<2optio27ap08c2Lp." 2d="L38" class="liine" name="i34"> 34 12span> 42 an clad withpan clasmarkad ATTR_KILL_PRIVe" name=="L42"> 42 42apan clasalassslt">as=nal crmarkad ATTR_KILL_PRIVe" name=="L42"> 42as iouidcommen="Li"L35, shoulde" name=="L42"> 42fnam12span> 42 42fnam12 <7a h1ref="securi2y/com2on8.c#1L486 18="L36" class="linp ass=scientlse Fre ; +rant">se Fre 3 42 *<12 8 *<12 uid_ne="_killprivfeinhe="cass=np optiouid_ne="_killpriv33_iseu fg "prouc" name=": T ryfeinhe="cass=np: T ryknt'u f_i setuid_: T ryfeinhe="cass=np: T ryknt&t=="L8"> 8 *<12 *2ent"> *<12 2ersion.<12span> 2ea> m12span> */<12span> 8 412>&gan> <9a h1ref="securi2y/com29a1p.c#L13" id=" id,924 2mman.h <"L33"> 82sp1an> <9a h1ref="securi2y/com29> 4.c#L348 id="L4" 1d="L43name="errorparoctivp rrorL33_f<r_0fp "f6" ="li+a> */<82pa1an> 3/a> m13sp2a> 3/a> m13sp2a; 3/a> m13sp2a; 3/a> m13sp2a; 42 42al nae" name=="L42"> 42 42.i 83sp2t; 42 83sa1an> *<13>&2a> 8 uid_killprivfeinhe="cass=np optiouid_killpriv33_iseu fg "prouc" name=": T ryfeinhe="cass=np: T ryknt'u f_i setuid_: T ryfeinhe="cass=np: T ryknt&t=="L8"> 8 */<13>&2t; *3nt"> */<13sp2 clat"> o2f="security3commo31app.c#L113 ideu fg "prouc" name="iouidapsparoin/commo ood v"imfzonf ij1 setuid_iouidapsparoin/commo ood v"imfp )2j1ff="ameuid_: T ryfeinhe="cass=np: T ryknt&vLr=e)2j1-" clname="d_iouidapsparoin/commod_iouidL33_EPERM)2j16" id,924 3/a> m13>> *3/a> m13>> 8 3/a> m13>> 83>> 3nnt">/*<93>> 3gemap.h> > 8 42> 8skin/com"L47"name="bprm_caps_=Do"_vfst> Lapsparoin/commobprm_caps_=Do"_vfst> L33_iseu fg "prouc" name="cpu_vfst> _datafeinhe="cass=np pu_vfst> _datav"imfzonf ij1 setuid_> Lapsparoin/commo> L33_ihtivp)2j1, etua> m13a>> 83a>> 8 *3ersion.<13>> 47cred option vLr=e)2j1 setuid_new> 47cred new> /ufp )2j1ff="ameuid_bprmapsparoin/commobprmknt&vLr=e)2j1-" clname="Lnd_fcapscred option l 4(="a06" id,924 3eswap.h> 3ebuff.h> 47re" option vret)2j1 =l06" id,924 3ef">fnam13>> Lapsparoin/commo> L33_ivLr=e)2j1-" clname="magic_etcapsparoin/commomagic_etcL33_f&j1 &n/com"L47"name="VFS_ optFLAGS_EFFECTIVEapsparoin/commoVFS_ optFLAGS_EFFECTIVEknt&t=="L8"> 8 3ea> m13span> 8 83span> 3erctl.h> 3/a> m13span> *3/a> m13>> > &a8.c#ed)2j1 = etuid_and_fcapsparoittp option vL33_ip )2j1ff="ameuid_a Lapsparoin/commo> L33_ivLr=e)2j1-" clname="and_fcapsparoittp option vL33_.)2j1ff="ameuid_a apsparoin/commo> L33_[ed)2j1 = etuid_iapsparoin/commo ion ]l 4(="a06" id,924 3ef">fnam13span> > &a8.c#ed)2j1 = etuid_and_fcapsparoinhe="cass=np option v">skinhe="cass="proeuid_a Lapsparoin/commo> L33_ivLr=e)2j1-" clname="and_fcapsparoinhe="cass=np option v">skin.)2j1ff="ameuid_a apsparoin/commo> L33_[ed)2j1 = etuid_iapsparoin/commo ion ]l 4(="a06" id,924 3ef">fnam13span> > 8 8 8 47cred new> /uvLr=e)2j1-" clname="L47"> 47L33_dclaittp option vL33_dcla.)2j1ff="ameuid_a apsparoin/commo> L33_[ed)2j1 = etuid_iapsparoin/commo ion ] ==="L8"> 8 83="L46"> 1 46{id,924<3optio34onc.c#L388 id="L47" cccccccccted)2j1 = etuid_new> 47cred new> /uvLr=e)2j1-" clname="L47"7L33_iseubse" optvL33_ise.)2j1ff="ameuid_a apsparoin/commo> L33_[ed)2j1 = etuid_iapsparoin/commo ion ] &j1 &n/com"L47"name="and_fcapsparoittp option vL33_i |=="L8"> 8 47cred new> /uvLr=e)2j1-" clname="L47"> 47/usecffeinhe="cass=np option v">skcffein.)2j1ff="ameuid_a apsparoin/commo> L33_[ed)2j1 = etuid_iapsparoin/commo ion ] &j1 &n/com"L47"name="and_fcapsparoinhe="cass=np option v">skinil 4(="a06" id,924 3/a> m13span> 13span> 47L33_dclaittp option vL33_dcla.)2j1ff="ameuid_a apsparoin/commo> L33_[ed)2j1 = etuid_iapsparoin/commo ion ]t=="L8"> 8 *<13span> oo4executop" rrtioly#3ne" name=="L8"> 8 *<13span> 47rcu_r option vret)2j1 =l-etuid_and_fcapsEPERM option vEPERM)2j16" id,924 3ent"> *<13span> 3ent"> *<13span> 3ea> m13) 8"seort. So s also set, then the intent is 3ersion.<13="L46"> 1546{id,924<3optio35ap08c2Lp." 2d="L38" class="l2Lp." 203 do4pclphave enoughre=nal csrort, wed="L47" an rrorentlip )s=, rt. So s also set, then the intent is 3erctl.h> some "="Lced" (aka file-ion vL33_)re=nal csrorta> 8 47rcu_r option :ret)2j1 =l06" id,924 3ent"> *<13span> *<13span> 8 *<13/span> <16a href="securi3y/com36n8.c#1L485 18="L35" class="linExtractentlipn-exec-clasy a.'s ort. >d=orean xecut> ortfilea> m13>> 8 L_=Do"_disead_lockck get_vfst> L_=Do"_diseknt&t="L47" clllll">prouc" name=": T ryfeinhe="cass=np: T ryknt'u f_i setuid_: T ryfeinhe="cass=np: T ryknt&,deu fg "prouc" name="Lpu_vfst> _datafeinhe="cass=np pu_vfst> _datav"imfzonf ij1 setuid_>pu_a Lapsparoin/commo>pu_a Lknt&t=="L8"> 8 1646{id,924<3optio3> 16.c27hre12o> *3"L33"> 13span> 3/a> m13span> 3/rsion.<13span> 3/a> m13>&gn> 3/rsion.<13>&gn> _datav"imf"cass="proeuid_a Lapsparoin/commo> L33_il 4(="a06" id,924 3/nt"> *<13span> *3/a> m13spaan> <7a h1ref="securi3y/com37a1p.c#L145 id="L47" clname="memL33_iseubse" memL33knt&ted)2j1 = etuid_>pu_a Lapsparoin/commo>pu_a Lknt&, 0,deizdofseu fg "prouc" name="cpu_vfst> _datafeinhe="cass=np pu_vfst> _datav"im)il 4(="a06" id,924 3ef">fnam13>&gan> <7a h1ref="securi3y/com37a1p.c#L13" id=" id,924 3/a> m13spaa; 8 746<1/a>{id,924<3optio37onc.c#L388 id="L47" cllllllllltion="a-etuid_aNODATAcapsEPERM NODATA33_il 4(="a06" id,924 3/L33"> 13span> 3/a> m13="Ln> m13>&gn> 3/a> m13span> 8as=nal crokline" name=="L8"> 8fnam13span> 3/a> m13 <8a h1ref="securi3y/com38a1p.c#L145 id="L47" cl 4(!namd_sizdapsparoin/commosizdion f<_0fp "f6" ="li+a>fnam13 <7a h1ref="securi3y/com38on9.c#L496 id="L47" c="L47" cltion="aname="sizdapsparoin/commosizdion l 4(="a06" id,924 3/a> m13 *<13 4.c#L348 id="L4" 1d="L43name="sizdapsparoin/commosizdion f<_eizdofsed)2j1 = etuid_magic_etcapsparoin/commomagic_etcL33_it=="L8"> 8 *<13 3ent"> *<13 *<13 pu_a Lapsparoin/commo>pu_a Lknt&vLr=e)2j1-" clname="magic_etcapsparoin/commomagic_etcL33_fp )2j1ff="ameuid_magic_etcapsparoin/commomagic_etcL33_fp )2j1ff="ameuid_le32_to_>puapsparoin/commole32_to_>puknt&ted)2j1 = etuid_> Lapsparoin/commo> L33_i.)2j1ff="ameuid_magic_etcapsparoin/commomagic_etcL33_il 4(="a06" id,924 3ea> m13span> *3nt"> */<13span> *3na> m13spann> <8a h1ref="securi3y/com39a1p.c#L145 iddddddddd="L4" 1d="L43name="sizdapsparoin/commosizdion f!p )2j1ff="ameuid_XATTR_ opS_SZ_1apsparoin/commoXATTR_ opS_SZ_1knt&t=="L8"> 8 413>&gan> <9a h1ref="securi3y/com39on9.c#L496 id="L47" ccccccccc5"L47" lltion="a-etuid_aINVALfeinhe="cass=npaINVALion l 4(="a06" id,924 3ea> m13>; 3ent"> *<13sp1an> <9a h1ref="securi3y/com39onc.c#L388 id="L47" cbreakl 4(="a06" id,924 3ent"> *<13pa1an> *4/a> m14sp2a> 8 4/a> m14sp2a; 4/3> m14span> 4/a> m14sp2a; *4/5> m14spann> <8a h1ref="securi4commo40a1p.c#L145 iddddddddd5"L47" lltion="a-etuid_aINVALfeinhe="cass=npaINVALion l 4(="a06" id,924 4/6> m14s&gan> <9a h1ref="securi4commo40on9.c#L496 id2Lp." 2d="L36d,924 4/7> m14sgt;; 84sp2t; > &knt&ted)2j1 = etuid_iapsparoin/commo ion ) 27hre12o> *4/933"> 84sa1an> 8 *<14>&2a> 4ersion.pu_a Lapsparoin/commo>pu_a Lknt&vLr=e)2j1-" clname="and_fcapsparoittp option vL33_.)2j1ff="ameuid_a apsparoin/commo> L33_[ed)2j1 = etuid_iapsparoin/commo ion ]fp )2j1ff="ameuid_le32_to_>puapsparoin/commole32_to_>puknt&ted)2j1 = etuid_> Lapsparoin/commo> L33_i.)2j1ff="ameuid_datafeinhe="cass=npdatav"im[ed)2j1 = etuid_iapsparoin/commo ion ].)2j1ff="ameuid_and_fcapsparoittp option vL33_il 4(="a06" id,924 4ea> m14>&2t; pu_a Lapsparoin/commo>pu_a Lknt&vLr=e)2j1-" clname="and_fcapsparoinhe="cass=np option v">skin.)2j1ff="ameuid_a apsparoin/commo> L33_[ed)2j1 = etuid_iapsparoin/commo ion ]fp )2j1ff="ameuid_le32_to_>puapsparoin/commole32_to_>puknt&ted)2j1 = etuid_> Lapsparoin/commo> L33_i.)2j1ff="ameuid_datafeinhe="cass=npdatav"im[ed)2j1 = etuid_iapsparoin/commo ion ].)2j1ff="ameuid_and_fcapsparoinhe="cass=np option v">skinil 4(="a06" id,924 4nt"> */<14sp2 clat"> o2f="security4commo41app.c#L113 id2Lp." 2d="L36d,924 4/a> m14>> *4/a> m14>> 4n6> m14>> 84>> 8/*<94>> oo4getentlipn-exec clasy a.'s ort. >d=orean xecut> ortfiled=Do"e" name=="L8"> 8ced: T c crobent"e" name=="L8"> 8>> 8 8 *4xattr.h> prouc" name=": T ryfeinhe="cass=np: T ryknt'u f_i setuid_: T ryfeinhe="cass=np: T ryknt&l 4(="a06" id,924 4xa> m14a>> 4xa> m14a>> _datav"imf "prouc" name="va Lapsparoin/commov> L33_il 4(="a06" id,924 4xL33"> 84a>> > 4ersion.<14>> > 8 4ef">fnam14>> 8 4ea> m14span> 4eL33"> 84span> > L_=Do"_diseknt&t="L47" clname=": T ryfeinhe="cass=np: T ryknt&he&j1 &"cass="proeuid_va Lapsparoin/commov> L33_iil 4(="a06" id,924 4/a> m14span> *4/a> m14>> 8fnam14span> "%s: get_vfst> L_=Do"_dised5"L47"="g%dd=ore%s\n"e" namectivp)2j1, etua>fnam14span> 4/race.h> 8 4/a> m14) 4/a> m14span> 84="L46"> 1 46{id,924<4optio44 16.c#L168 id="L33" class="line" name4/rctl.h> Lapsparoin/commobprm_caps_=Do"_vfst> L33_is&j1 &"cass="proeuid_va Lapsparoin/commov> L33_icc9u f_i setuid_bprmapsparoin/commobprmknt&cc9u f_i setuid_and_fcapsparoctivp option vL33_cc9u f_i setuid_ opts="apsparoin/commo opts="knt&tl 4(="a06" id,924 4/a> m14span> 8 14span> "%s: > _=Do"_dised5"L47"="g%dd=ore%s\n"e" namectivp)2j1, etua> *<14span> 4ent"> *<14span> *<14span> *4ent"> *<14span> 4ea> m14) 8 m14{ Lapsparoin/commobprm_cleart> L33_is9u f_i setuid_bprmapsparoin/commobprmknt&il 4(="a06" id,924 4ersion.<14="L46"> 1546{id,924<4optio45 16.c#L168 id="L33" class="line" name4erctl.h> 4ersion.<14span> *<14span> 42 *<14span> "set upentliild t 424ent"> *<14/span> <16a href="securi4y/com46n8.c#1L485 18="L35" class="li 424ea> m14>> 8 8 1646{id,924<4optio46ap08c2Lp." 2d="L38" class="li which won=nal t takoh optio icladiatelya =p ass=scientlsu" namful3 14span> 8 "bprm_set_ced:sknt&teu fg "prouc" name="ptiux_b_fprmapsparoin/commoptiux_b_fprmknt'u f_i setuid_bprmapsparoin/commobprmknt&t=="L8"> 8 *4/a> m14>&gn> prouc" name="c47"> 47cred option vLr=e)2j1 setuid_ol"> 47cred ol"L33_fp /com"L47"name="n crass_c47"> 47cred crass_c47"knt&til 4(="a06" id,924 4/rsion.<14>&gn> 47cred option vLr=e)2j1 setuid_new> 47cred new> /ufp )2j1ff="ameuid_bprmapsparoin/commobprmknt&vLr=e)2j1-" clname="Lnd_fcapscred option l 4(="a06" id,924 4/nt"> *<14span> 4/nt"> *<14spaan> <7a h1ref="securi4y/com47a1p.c#L145 id=kin/com"L47"name="L47"> 47re" optionl 4(="a06" id,924 4/a> m14>&gan> <7a h1ref="securi4y/com476p..c#L144 id9u f_i setuid_kuid_7"> 47re" kuid_7knt u f_i setuid_root_uid"> 47re" oot_uidtionl 4(="a06" id,924 4/a> m14spaa; m14 746<1/a>{id,924<4optio47onc.c#L388 idltion="a-etuid_and_fcapsparoctivp option vL33_fp )2j1ff="ameuid_f crrparoittp f crrion l 4(="a06" id,924 4/L33"> 14span> 47rcu_r option vr/com"L47"name="get_file_a Lapsparoin/commoget_file_a Lknt&t9u f_i setuid_bprmapsparoin/commobprmknt&cc&j1 &"cass="proeuid_and_fcapsparoctivp option vL33_cc&j1 &"cass="proeuid_ opts="apsparoin/commo opts="knt&tl 4(="a06" id,924 4/a> m14="Ln> 47rcu_r option <_0fp "f6" ="li+a> 47re" optionl 4(="a06" id,924 4/a> m14span> 47re" oot_uidtionfp )2j1ff="ameuid_make_kuid"> 47re" make_kuidknt&t9u f_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="user_nLapsparoin/commouser_nLL33_cc0il 4(="a06" id,924 4/f">fnam14span> *4/a> m14 <8a h1ref="securi4y/com48a1p.c#L145 id="L47" cl 4(!name="ispan caroinhe="cass=np span caknt&t9u f_i setuid_SECURE_NOROOTroinhe="cass=npSECURE_NOROOTknt&tf 27hre12o> *4/f">fnam14 <7a h1ref="securi4y/com4gan> <7a h1ref="securi2Lp." 2d="L38" class="lie" name=="L8"> 8asen d=nal t tat_crivil424ent"> *<13<4aa; 4ent3"> 14spaa> *<13<4an> 8 *<13<4an> 47re" madknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp) 1 &"c1 &n/ccl 4(!name="isd_7keqsparoin/commouse_7keqt&t9u f_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="used"> 47re" oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)27hre12o> *4/f> m13s4an> 4en> m13s4an> 4/a"> */<13s4an> 8 413>4gan> <9a h1ref="securi3y4com3949.c#1L486 18="L36" class="l2Lp." 20="L47" #3ne Toupportd="ption v"nce ofeot_uon vL3ssionmme,cuppid-ot_u name=="L8"> 8 ortfs und_n clapati;s ort.md_owed="overrido s a name=="L8"> 8 *<13<41an> <9a h1ref="securi3y4com394908c2Lp." 2d="L38" class="l2Lp." 203 * 's ort. >d=orean )selea> *<13p41an> m14s52a> m14s52a; 8 47cred new> /uvLr=e)2j1-" clname="used"> 47re" oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)|47" cl 4(!namd_sid_7keqsparoin/commouse_7keqt&t9u f_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="use"> 47re" madknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)27hre12o> *4/5> m14s5an> 8 47L33_dclaittp option vL33_dcla.)="cass="proeuid_a La_clab="secittp optioclab="st&t9u f_i setuid_ne"> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L33_iseubse" optvL33_ise.)ivp)2j1, etua> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47/usecffeinhe="cass=np option v">skcffein.) 4(="a06" id,924 4e5> m14s5gan> <9a h1ref="securi4c5mmo4050> <7a h1ref="securi2Lp." 2d="L36d,924 4e5> m14s5t;; 47cred new> /uvLr=e)2j1-" clname="used"> 47re" oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp) "f6" ="li+a> 84s52t; 3e533"> 84s51an> *<14>52a> *4e5sion. 4e5> m14>52t; dangerous n vsona ort.agLL3 *" name=="L8"> 8 */<14s52 clat"> o2f="security4c5mmo415pp.c#L113 id2LL47" cl 4(!name="isptionssu33_iseubse" optvLnssu33_it&t9u f_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaittp option vL33_dcla.)9u f_i setuid_Lc"> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_dclaittp option vL33_dcla.)) "f6" ="li+a> 3e5> m14>5gt; 3e5> m14>5gt; 8 84s5gt; m14s52a; oo4g T c cro=t your option) any later 3e5> m14s52at; m14s52at; */<14s52 t; 47re" oedknt&t99u f_i setuid_Lcat_uid"> 47 ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_d madknt&t99u f_i setu!nam> */<14s52 tlat"> o2f="security4commo42a8.c#25112 252"L47" cbrdddddd="p="isptionssu33_ig/commouse_7keqt&t9u gf_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="used"> 47re" g oedknt&t99u fgi setuid_Lcat_uid"> 47 ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_dg oedknt&t99u gi setu!nam> */<14s52 t 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaittp option vL33_dcla.)9u f_i setuid_Lc"> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_dclaittp option vL33_dcla.)) "f6" ="li+acl 4(!name> */<14s52 t *4/5> m14s5ant; downgrade;o ion c clno moraraaass ion , d,_u namaybvi wsL8"> 8 */<14s52 t; skcffe="a06" id_new> 47cred >&kn="aommoMNT_NOSUIDknt&>&kn="aommsetu!nam> */<14s52 t *4/5> m14s5ant; /uvLr=e)2j1-" clname="used"> 47re" oedknt&t99u f_i setuuid_f sparoctivp new> /uvLr=e)2j1-" clname="use"> 47re" madknt&t99u f_i setue> */<14s52 ; 47re" g oedknt&t99u fgi setuuid_f sparoctivp new> /uvLr=e)2j1-" clname="use"> 47re" g oedknt&t99u gi setue> */<14s52 ;; *<14>52a; 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaittp option vL33_dcla.)="cass="proeuid_a La_clab="secittrtd="n> optvLnssu33_it&t9utd="n> etuid_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaittp option vL33_dcla.)9u f_i setui924 4e5t"> *<14>52a;lat"> o2f="security4commo43ca8.c#548" i53"L47" c="L47" c#L399 id=u f_i setuidlllllbreakl 4(="a0_new> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_dclaittp option vL33_dcla.)) "f6" ="li+e> */<14s52 ; 4e5t"> *<14>52a; 3e5> m14>5gt> 47re new> /uvLr=e)2j1-" clname="usc"> 47L33_ds madknt&t99u fs_i setuuid_f sparoctivp new> /uvLr=e)2j1-" clname="use"> 47re" fs madknt&t99u ffs_i setuuid_f sparoctivp new> /uvLr=e)2j1-" clname="use"> 47re" oedknt&t99u f_i setue> */<14s52 ;; /uvLr=e)2j1-" clname="usc"> 47L33_dsg oedknt&t99u sgi setuuid_f sparoctivp new> /uvLr=e)2j1-" clname="use"> 47re" fsg oedknt&t99u fsgi setuuid_f sparoctivp new> /uvLr=e)2j1-" clname="use"> 47re" g oedknt&t99u fgi setue> */<14s52 ; &g5; 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaitivp option vL33_fclaitivp setuuid_f sparoctivp new> /uvLr=e)2j1-" clname="use"> 47re" claittp option vL33_dcla.)) "f6" ="lie> */<14s52 ; */<14s52 ; 47L33_dclaitivp option vL33_fclaitivp setu+e> */<14s52 > 47commobprmknt&vLr=e)2j1-" clname="Lnd_fcapscred laitivp option vL33_fclaitivp setuuid_f sparoctivp tivp option vL33_fp )2j1ff="amee> */<14s52 > *4/a> m14 8 413>4g5) 413>4g5); 8 413>4g5) {id,924<4optio44 16.c#5168 i54"L38" class="li"L47" c#L*ed: T c cro=oWtlipnptiobother 413>4g5) oo4g T c cro=cro1) dlaitivp nhaame=l _i set 8 413>4g5> 8 m14s52a> 413>4g5> 413>4g5> m14s52a> 8 */<14s52 { .c#cittsepcommetuid_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaitivp option vL33_fclaitivp setu+an class="comment"> *4/5> m14s5an6"> 1546<5a>{id,924<4optio45 16.c#5168 i55"L47" cccccccccteion=name="isptionssu33_iseubse" optvLnssu33_it&t9u f_i setuid_new> 47cred >&kntULLn="aoMNT_NOSUIDknt&>&kntULLn="asetuid_Lc"> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaitivp option vL33_fclaitivp setu+nam> */<14s52 ; 47re" oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)|47" cl 4(!namd="isd_7keqsparoin/commouse_7keqt&t9u f_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="use"> 47re" madknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp) 1 &"c1 &n/ccam> */<14s52 > 47="cass=np span caknt&t9u f_i setuid_SECURE_NOROOTroinhe="cass=npSECURE_NOROOTknt&tf 27hre12o> *4/f">fnam14 47r option vr/com"L47"name="get_file_a Laiudit_logsknt&t&t9u option vr/comiudit_logsknt&t&t9u etuid_SECURE_NOROOTrcommobprmknt&cc9u f_i setuid_and_fcapsparoc new> /uvLr=e)2j1-" clid_Lc"> 47cred ol"L33_fpr=e)2j1-" cl+e> */<14s52 > 47rcu_r option <_0fp "f6" ="li+a> 47re" optionl 4(="a06" id,924 4/a> m14spa5> 4er> m13s4a5n 4/5> m14>5gt{ /uvLr=e)2j1-" clname="usc"> 47L33_dsf_i sbit option vr/comsf_i sbit &n/c cl 4=id_new> 47cred u f_i s_ma get_vfst> L_=u f_i s_ma etuid_SECURE_NOROOTroinhe="KEEPt=="LpSECURE_NOROOTknt&tf 2KEEPt=="L" cl+e> */<14s52 >"> 1546<5a>{id,924<4optio46ap08c25p." 256"L47" ccccccc"a06" id,924 4ea> m14spa5> 4er> m13s4a5> &g5> 42"momm whether 8 84s5gt> "s 8 84s5gt> 84s5gt>> <16a h5ef="securi4y/com47a1p.c#5145 i57"L35" class="li 42"momm whether,c"a06" i1dtuiit ts,_u na0 8 84s5gt> 1546<5a>{id,924<4optio47onc.c#5388 i57"L38" class="li which won=nal parcontfsssparoi, earbee"e" m "f6" _u ethisgpoin"ien namosararno loona t your option) any later 3e5> m14s52a; oo4getavaile" nathroughtoissal naed,e"at your option) any later 3e5> m14s52a> */<14s52 > 8 *4/f">fnam14 prouc" name="c47"> 47cred option vLr=e)2j1 setuid_ol"> 47cred option vLr=e)2j1 setuie="n crass_c47"> 47cred crass_c47"knt&til 4(="a06" id,924 4/rsion.<14>&g5> 47re" oot_uidtionl 4(="a06" iduid_make_kuid"> 47re" make_kuidknt&t9u f_i setuid_new> 47cred option vLr=e)2j1 setuname="user_nLapsparoin/commouser_nLL33_cc0il 4(="a06" id,924 4/f">fnam14spa5n> <8a h15ef="securi4y/com48a1p.c#5145 i58" id,924 3e5> m14>5gtn> <7a h15ef="securi4y/com4gan> <75 h1re58"L4onf ij1 setuid="isd_7keqsparoin/commouse_7keqt&t9u f_i setuid_new> 47cred option vLr=e)2j1 setuname="user_nLapsparoi madknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)27hre12o> *4/5> m14s5an; "> 1546<5="security3c4mmo384808c25p." 258"L47" cccccccccteion="a-etuid"a06" i1,924 4/f">fnam14spa5n .c#cittsepcommetuid_new> 47cred option vLr=e)2j1 setuname="user_nLapsparoclaittp option vL33_dcla.)) "f6" ="li+a> 4/f">fnam14spa5> 4/a> m14spa5> 47 option vLr=e)2j1 setuname="user_nLapsparoi madknt&t99u f_i setuccam> */<14s52 > 47cred option vLr=e)2j1 setuname="user_nLapsparo g oedknt&t99u fgi setuid_Lcat_uid"> 47 option vLr=e)2j1 setuname="user_nLapsparog oedknt&t99u gi setu!d,924 4/f">fnam14spa5n> <8a h15ef="securi3y4com3941p.c#5145 i5dddddd,924 4er> m13s4a5>> <7a h15ef="securi3y4com3949.c#15486 159" id,924 4/5> m14>5gt; 42"momm whether 42me=="L8"> 42 42 42 42 42 84s5g6n> <8a h16ef="securi4c5mmo4051p.c#6145 i60"L35" class="li 42"momm whetherml3 84s5g6n6 <8a h16ef="securi3y4com3949.c#16 h1re60"L36" class="li Set upentliilde,cuppid-o tsngrant">,c m14s526; dsci" oron vLu ethosp> 42 m14s526> */<14s526; .c#cittsnparfps_xattretuid" name="ptiux_b_fprmapcass=np: T ryknt&#p )2j1ff="ameud_ol"> 47cred cass=np: T ryknt&he&j1 &"cass="pr>proucchsrid_new> 47cred fileecur33_iil="a06" ii924 4e5t"> *<14>526; proucvoidid_new> 47cred valup fileecur33_iilvalup> tuid_Lcat_uid"> 47sizp kuid_7knt u sizp etuid_root_uid"> 47sizp kuid_7knt u sizp> tuidame="L47"bprm_set_ce=="L kuid_7knt u e=="Lsetua> o26="security4c5mmo415pp.c#6113 i62LL47" class="comment"> *4/5> m14s5a6; 47cred fileecur33_iil="a06" ii="L47"bprm_set_cXATTR_NAMEt=="LpSECURE_NOROOTkXATTR_NAMEt=="Lo> *4/5> m14s5a6; skcffe="a06" id_new> 47cred >&kn="aF&"c u sion l 4(=>&kn="aF&"c="li+a> 4/a> m14spa6; 4ea> m14spa6; 4er> m13s4a6; 4er> m13s4a6t; 47cred fileecur33_iil="a06" ii="L47"bprm_set_cXATTR_nt&tfITY_PREFIXpSECURE_NOROOTkXATTR_nt&tfITY_PREFIX6" ii924 4e5t"> *<14>526t; 47cred XATTR_nt&tfITY_PREFIXpSECURE_NOROOTkXATTR_nt&tfITY_PREFIX6" i)s- 1acl 4(!name> */<14s526t; skcffe="a06" id_new> 47cred >&kn=YS_ADMIN u sion l 4(=>&kn=YS_ADMIN="li+a> o26="security4commo42a8.c#26112 262"L47" cbrdddddd="p47""a06" id_aINVALfeinhe="cPERM u sion l 4(=cPERM" id,924 4/a> m14spa6t 4ea> m14spa6t 4/5> m14>5g6t; 42"momm whether 42me=="L8"> 42 42 42"momm whetherml3 84s5g6;lat"> o26="security4commo43ca8.c#648" i63"L43" class="lin> _bprm_set_ce,cuppid-o tsngrant">,c m14s526; 84s5g6; 84s5g6;; m14s526;; */<14s526; .c#cittsnparfremovexattretuid" name="ptiux_b_fprmapcass=np: T ryknt&#p )2j1ff="ameud_ol"> 47cred cass=np: T ryknt&he&j1 &"cass="pr>proucchsrid_new> 47cred fileecur33_iil="a06" ia> *4/5> m14s5a6> 47cred fileecur33_iil="a06" ii="L47"bprm_set_cXATTR_NAMEt=="LpSECURE_NOROOTkXATTR_NAMEt=="Lo> *4/5> m14s5a6; skcffe="a06" id_new> 47cred >&kn="aF&"c u sion l 4(=>&kn="aF&"c="li+a> 4/a> m14spa6> 4ea> m14spa6> 4e5t"> *<14>526> 3e5> m14>5g6) 47cred fileecur33_iil="a06" ii="L47"bprm_set_cXATTR_nt&tfITY_PREFIXpSECURE_NOROOTkXATTR_nt&tfITY_PREFIX6" ii924 4e5t"> *<14>526); 47cred XATTR_nt&tfITY_PREFIXpSECURE_NOROOTkXATTR_nt&tfITY_PREFIX6" i)s- 1acl 4(!name> */<14s526) {id,924<4optio44 16.c#6168 i64"L47" cccccccccte="isptionssu33_iseuss=np option v">skcffe="a06" id_new> 47cred >&kn=YS_ADMIN u sion l 4(=>&kn=YS_ADMIN="li+a> 4/a> m14spa6> 4ea> m14spa6> *<14>526> 4/a> m14spa6> 8 413>4g6> d=orean iesLog 8 84s5g6> 8 413>4g6>; m_7"="_ t_c[of {r,e,s}"4pc==ml3_to_re=l og 8 84s5g6> {id,924<4optio45 16.c#6168 i65"L38" class="l2Lp." 203 "c {r,e,s}"4pc!=hase3 fp)) "f6" n natd=orean iesLarp> 42 m14s526> m14s526> m_7"="_ e"4pc==ml3_to_re"4pc!=hase3 fptivp seyour option) any later 3e5> m14s526> d=orean iesLoge3 fp)arn r are pcomme"at your option) any later 3e5> m14s526> m_7"="_ e"4pc!=ml3_to_re"4pc==hase3 fptivp seyour option) any later 3e5> m14s526> d=orean iesat your option) any later 3e5> m14s526> 8 413>4g6{ 42 1546<6a>{id,924<4optio46ap08c26p." 266"L38" class="l2Lp." 203 "c never *<13<4a6> *<13<4a6> m14s526> *<13<4a6> *<13<4a6> m12="Ln>4ent3"> 14spa6> 4ent3"> 14spa6> wi=l bem"a0a/co"at your option) any later 3e5> m14s526> m14s526; m14s526;"> 1546<6a>{id,924<4optio47onc.c#6388 i67"L38" class="li which won=nal Keep8">m_i g0 tsnpti m14s526; oo4get (s.at your option) any later 3e5> m14s526> " B(=iea m14s526> */<14s526> 47=ncommo4 sion l 4(==ncommL4onfvoidi"L47"bprm_set_ced:semulatrfps_xuidobpn vleart>.c#cittemulatrfps_xuidetuid" name="ptiux_b_fprmap option vLr=e)2j1 setuid_ol"> 47cred new> /uvLr=e)2j1-" clid>prouc" name="c47"> 47cred option vLr=e)2j1 setuid_ol"> 47cred ol"L33_fpr=e)2j1-" cl+> */<14s526> *4/5> m14s5a6> 47re" oot_uidtionl 4(="a06" iduid_make_kuid"> 47re" make_kuidknt&t9u f_i setuid_new> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_d n/commouser_nLL33_cc0il 4(="a06" id,924 4/f">fnam14spa6n> <8a h16ef="securi4y/com48a1p.c#6145 i68" id,924 3e5> m14>5g6n> <7a h16ef="securi4y/com4gan> <76 h1re68"L4onf ij1 setuidd_Lcd_7keqsparoin/commouse_7keqt&t9u f_i setuid_new> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_d madknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp) 1 &"c1 &n/ccam> */<14s526; 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_d oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)|47" cl 4(!nam> */<14s526;"> 1546<6="security3c4mmo384808c26p." 268"L47" ccccccccctei_Lcd_7keqsparoin/commouse_7keqt&t9u f_i setuid_new> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_ds madknt&t99u fs_i setuid_Lcat_uid"> 47re" oot_uidtionfp)27hre12o> */<14s526n 47cred new> /uvLr=e)2j1-" clname="used"> 47re" madknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp) 1 &"c1 &n/ccl 4(!name> */<14s526> 47re" oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)|47" cl 4(!nl 4(!name> */<14s526> 47cred new> /uvLr=e)2j1-" clname="used"> 47re" s madknt&t99u fs_i setuid_Lcat_uid"> 47re" oot_uidtionfp)27hre12o> */<14s526> *4/5> m14s5a6> .c#cittpcommetuid_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaittp option vL33_dcla.)) "f6" ="li+e> */<14s526> .c#cittpcommetuid_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaitivp option vL33_fclaitivp setu+e> */<14s526n> <8a h16ef="securi3y4com3941p.c#6145 i69ddddddd#L399 ,924 4er> m13s4a6>> <7a h16ef="securi3y4com3949.c#16486 169"L4onf ij1 setuid_Lcd_7keqsparoin/commouse_7keqt&t9u f_i setuid_new> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_d oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)|47" cl 4(!nl 4(!namee="isptionssu33_in/commouse_7keqt&t9u f_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="used"> 47re" oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)|47" cl 4(!+> */<14s526; .c#cittpcommetuid_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaitivp option vL33_fclaitivp setu+e> */<14s526n"> 1546<6ef="securi3y4com394908c26p." 2698L4onf ij1 setuid="isptionssu33_in/commouse_7keqt&t9u f_i setuid_new> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_d oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)|47" cl 4(!nl 4(!namee"isptionssu33_in/commouse_7keqt&t9u f_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="used"> 47re" oedknt&t99u f_i setuid_Lcat_uid"> 47re" oot_uidtionfp)|47" cl 4(!+> */<14s526; 47L33_dclaitivp option vL33_fclaitivp setuuid_f sparoctivp new> /uvLr=e)2j1-" clname="use"> 47re" claittp option vL33_dcla.)) "f6" ="lie> */<14s527> 4er> m13s4a7>1 424 426 429,c"a06" 8">ml3tongrantraarcohsonas,c m14s527> */<14s527; 47cred new> /uvLr=e)2j1-" clid>prouc" name="c47"> 47cred option vLr=e)2j1 setuid_ol"> 47cred ol"L33_fpr=e)2j1-" clidame="L47"bprm_set_ce=="L kuid_7knt u e=="Lsetua> *4/f">fnam14 o27="security4c5mmo415pp.c#7113 i71"L47" cbrddddmwitchid_Lcd_7keqsparoie=="L kuid_7knt u e=="Lsetuan class="comment"> *4/5> m14s5a7; *4/5> m14s5a7;5 *4/5> m14s5a7;6 *4/5> m14s5a7; 42 8 */<14s527;9 */<14s527t; .c#cittemulatrfps_xuidetuid_ol"> 47cred new> /uvLr=e)2j1-" clid_ol"> 47cred ol"L33_fpr=e)2j1-" cl+e> */<14s527t; */<14s527t 4/a> m14spa7tlat"> o27="security4commo42a8.c#27112 272"L47" cbrddddcase="L47"bprm_set_cLSMn="aID_FLpSECURE_NOROOTkLSMn="aID_FLL47":class="comment"> *4/5> m14s5a7t 42 42 42&kntS_MASKcod=orean ies?> 42 42 8 */<14s527; *4/5> m14s5a7;; 47" kuid_7knt u f_i setuid_root_uid"> 47re" oot_uidtionl 4(="a06" iduid_make_kuid"> 47re" make_kuidknt&t9u f_i setuid_new> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_d n/commouser_nLL33_cc0il 4(="a06" id,924 4/f" m14s5a7; 47rcu_rn/commouse_7keqt&t9u f_i setuid_new> 47cred ol"L33_fpr=e)2j1-" clname="L47"7L 47L33_dfs madknt&t99u ffs_i setuid_Lcat_uid"> 47re" oot_uidtionfp)27hre12o> 47re" fs madknt&t99u ffs_i setuid_Lcat_uid"> 47re" oot_uidtionfp)27hre12o> */<14s527;lat"> o27="security4commo43ca8.c#748" i73"L47" c="L47" c#L399 id=u f_i setuid_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaitivp option vL33_fclaitivp setuui> */<14s527; 47L33_dclaitivp option vL33_fclaitivp setu+e> */<14s527; 3e5> m14>5g7;; 47re" oot_uidtionfp)27hre12o> 47cred new> /uvLr=e)2j1-" clname="used"> 47re" fs madknt&t99u ffs_i setuid_Lcat_uid"> 47re" oot_uidtionfp)27hre12o> */<14s527; 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaitivp option vL33_fclaitivp setuui> */<14s527; 47L33_dclaitivp option vL33_fclaitivp setui924 4e5t"> *<14>527; 47L33_dclaittp option vL33_dcla.)) "f6" ="li+e> */<14s527> 4er> m13s4a7; */<14s527; 4/a> m14spa7> *4/5> m14s5a7> */<14s527> 4/5> m14>5g7); 4ea> m14spa7) {id,924<4optio44 16.c#7168 i74"L47",924 4er> m13s4a7) 4er> m13s4a7> 8 413>4g7> 4ent3"> 14spa7> 4ent3"> 14spa7> 42 42 paisg d=insufficil now since you 42d=sat your option) any later 3e5> m14s527> {id,924<4optio45 16.c#7168 i75"L38" class="l2Lp." 203 "cSoscheckmd=slon aarctargtas)arn rat your option) any later 3e5> m14s527> 8 */<14s527> 47cred mo oskiponl hre1psetua> *4/5> m14s5a7> */<14s527> */<14s527> */<14s527> ittse ub optvLnssu33_i ittse ub etuid_new> 47cred _.task_ option vLr=e)_.task_ etuid_new> 47cred mo oskiponl hre1psetuaname="usc"> 47L33_dclaittp option vL33_dcla.)) "f6" ="lii924 4e5t"> *<14>527> 47cred c47cred crass_c47"knt&til 4(="a06" idname="usc"> 47L33_dclaittp option vL33_dcla.)) "f6" ="li+e> */<14s527{ */<14s527> {id,924<4optio46ap08c27p." 276"L38"> */<14s527> skcffe="a06" id_new> 47cred >&kn=YS_NICE kuid_7knt u >&kn=YS_NICEo> */<14s527> 4/a> m14spa7> 4ea> m14spa7> 4er> m13s4a7> */<14s527> 42momm namachedulerspolicymchsonag d=)) "f6" =" 42 momm nam3 fpreques6" achedulerspolicymchsonag d=)) "f6" m oo4getspecifia"stask,c"a06" 8">ml3,c m14s527> */<14s527> 47cred mo oskiponl hre1psetua> *4/f">fnam14 47cred mo oskiponl hre1psetua,924 4ea> m14spa7> 4er> m13s4a7n> <8a h17ef="securi4y/com48a1p.c#7145 i78" id,924 3e5> m14>5g7n> <7a h17ef="securi4y/com4gan> <77 h1re78"L36" class="li Set upentli42"> 42momm namI/O pano"commchsonag d=)) "f6" =" 42 1546<7="security3c4mmo384808c27p." 278"L38" class="li which won=nal @pn parctaskLey"aivp =" 42 m14s527> momm nam3 fpreques6" I/O pano"commchsonag d=)) "f6" m m14s527> ml3,c m14s527> */<14s527> 47cred mo oskiponl hre1psetuidame="L47"bprm_set_cioprio option vL33_dioprioetuia> *4/f">fnam14> <7a h17ef="securi3y4com3949.c#17486 179"L4onf ij1 se"a06" i"L47"bprm_set_ced:ssafe_nice option vL33_dcla.safe_niceetuid_ol"> 47cred mo oskiponl hre1psetua,924 4ea> m14spa7; 4er> m13s4a7n"> 1546<7ef="securi3y4com394908c27p." 279"L38"> */<14s527; 42momm namtaskLpano"commchsonag d=)) "f6" =" 4223momm nam3 fpreques6" taskLpano"commchsonag d=)) "f6" m5ml3,c m14s528>6 */<14s528; 47cred mo oskiponl hre1psetuidame="L47"bprm_set_cnice option vL33_dniceetuia> *4/f">fnam149 47cred mo oskiponl hre1psetua,924 4ea> m14spa8> 4er> m13s4a8; */<14s528clat"> o28="security4c5mmo415pp.c#8113 i81"L43" class="lin> _bprm_seo* Impleprm_ PRt=="BSET_DROP. Af6"mptstolremovesaam specifia"scd=orean y 7"=" 8 */<14s528c4mele. Ra06" sg0 on sucn r,c m14s528;5 */<14s528;6m"usc"> 47L33_dclaitactl9drop option vL33_dcla.)actl9dropetuid" name="ptiux_b_fprmap option vLr=e)2j1 setuid_ol"> 47cred new> /uvLr=e)2j1-" clidunsigna"slo">m"usc"> 47L33_dcla option vL33_dclaetuia> *4/f">fnam14skcffe="a06" id_new> 47cred >&kn=ETP&"c u sion l 4(=>&kn="aP&"c="li+a> 4/a> m14spa8t; 47cred cla option vL33_dclaetuiaa> */<14s528t 4/a> m14spa8tlat"> o28="security4commo42a8.c#28112 282"L47" cbrdddd"isptionssu33_iceu_lowpr option vL33_dcla.lowpr6" id_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaib optvLnssu33_i ittb ="liid_Lcat_uid"> 47cla option vL33_dclaetuiae> */<14s528t4 4ea> m14spa8t 4er> m13s4a8t6 4/5> m14>5g8t 42 42 42 42 *<13<4a8; " cd=orean ies; mayt your option) any later 4"Lt"> *<13<4a8;lat"> o28="security4commo43ca8.c#848" i83"L43" class="lin> _bprm_seo* alsy"denysacn rLey"other funcent"sLpti 42 42 42,csys_pactl() n n"other LSM> 42 42 8 */<14s528; m"usc"> 47L33_darg2 option vL33_darg2" clidunsigna"slo">m"usc"> 47L33_darg3 option vL33_darg3="lii924 4e5t"> *<14>528> m"usc"> 47L33_darg4 option vL33_darg4" clidunsigna"slo">m"usc"> 47L33_darg5 option vL33_darg5etuia> *4/5> m14s5a8; 47cred new> /uvLr=e)2j1-" cl,924 4ea> m14spa8> m"usc"> 47L33_derror new> /uvLr=e)2errorL47" =id,924 4ea> m14spa8> 4ea> m14spa8> prepare4(="amouser_nLL33_cc0prepare4(="ametuid+e> */<14s528) 4ea> m14spa8> {id,924<4optio44 16.c#8168 i84"L38"> */<14s528) *4/5> m14s5a8> *4/5> m14s5a8> 47L33_derror new> /uvLr=e)2errorL47" =id_aINVALfeinhe="cINVAL option vL33_dcINVAL="lie> */<14s528> 47cred arg2 option vL33_darg2" claa> 47L33_derror new> /uvLr=e)2errorL47"e> */<14s528> /uvLr=e)2errorL47" =i!="isptionssu33_iceu_raisedobpn vleart>.c#cittraised6" id_new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_dclaib optvLnssu33_i ittb ="liid_Lcat_uid"> 47arg2 option vL33_darg2" clae> */<14s528> 47L33_dno_chsona new> /uvLr=e)2jo_chsonaL47"e> */<14s528> 4/5> m14>5g8>; *4/5> m14s5a8> {id,924<4optio45 16.c#8168 i85"L47" cccccccccteion="L47"bprm_set_cerror new> /uvLr=e)2errorL47" =i"usc"> 47L33_dclaitactl9drop option vL33_dcla.)actl9dropetuid_ol"> 47cred new> /uvLr=e)2j1-" clid_Lcat_uid"> 47arg2 option vL33_darg2" clae> */<14s528> /uvLr=e)2errorL47" < 0a> 47L33_derror new> /uvLr=e)2errorL47"e> */<14s528> 47L33_dchsona" option vL33_dchsona"> 7"e> */<14s528> 4/a> m14spa8> */<14s528> */<14s528> */<14s528> */<14s528>; m14s528> {id,924<4optio46ap08c28p." 286"L38" class="l2Lp." 203 T c cro2 8 */<14s528> */<14s528> */<14s528> */<14s528> */<14s528> */<14s528> */<14s528> */<14s528> */<14s528>; */<14s528> {id,924<4optio47onc.c#8388 i87"L38" class="li which won=na T c cro* wi=l ensuraraaat tarcc&til )arn r n n"e=l of ito> 42oo4g T c cro*cohildil wi=l be lock" inty"acpurp> 42 m14s528> */<14s528> *4/5> m14s5a8> /uvLr=e)2errorL47" =id_aINVALfeinhe="cPERM u sion l 4(=cPERM" id,924 4/a> m14spa8> 47L33_d f_i sbito new> /uvLr=e)2 f_i sbitoL47" &namee"isptionssu33_int&tf 2ALL_LOCKLpSECURE_NOROOTknt&tf 2ALL_LOCKL" cl+name=ame= 1a> 47L33_d f_i sbito new> /uvLr=e)2 f_i sbitoL47" ^d_Lcat_uid"> 47arg2 option vL33_darg2" cla) celp." 2d="L36dddddd dd"class="line" name=="L42[1]*> 8 */<14s528> 47L33_d f_i sbito new> /uvLr=e)2 f_i sbitoL47" &namee"isptionssu33_int&tf 2ALL_LOCKLpSECURE_NOROOTknt&tf 2ALL_LOCKL" cl &namee~_Lcat_uid"> 47arg2 option vL33_darg2" cla) ce"class="line" name=="L42[2]*> 8 */<14s528>; 47arg2 option vL33_darg2" cl &namee~d_SECURE_NOROOTroinhe="ALL_LOCKLpSECURE_NOROOTknt&tf 2ALL_LOCKL" cl |e"isptionssu33_int&tf 2ALL_BITS kuid_7knt u nt&tf 2ALL_BITS" cla) ce"class="line" name=="L42[3]*> 8 */<14s528> 47cla.ceuss=np option v">skcffe.ceuss=n6" id_new> 47cred c47cred crass_c47"knt&til 4(="a06" idi924 4e5t"> *<14>528n &kn=ETP&"c u sion l 4(=>&kn="aP&"c="lii924 4e5t"> *<14>528> 47cred nt&tfITYt=="_AUDIT kuid_7knt u nt&tfITYt=="_AUDIT" cl+n!= 0) celp." 2d="class="line" name=="L42[4]*> 8 */<14s528> */<14s528> */<14s528> 42 42 */<14s528; 8 */<14s528> m14>5g8; 8 */<14s529> 47L33_derror new> /uvLr=e)2errorL47"e> */<14s529>1 47L33_d new> /uvLr=e)2j1-" clname="usc"> 47L33_d f_i sbito new> /uvLr=e)2 f_i sbitoL47" =i"usc"> 47L33_darg2 option vL33_darg2" cle> */<14s529>2 47L33_dchsona" option vL33_dchsona"> 7"e> */<14s529>3 */<14s529>4 *4/5> m14s5a9>5 /uvLr=e)2errorL47" =i"usc"> 47L33_d new> /uvLr=e)2j1-" clname="usc"> 47L33_d f_i sbito new> /uvLr=e)2 f_i sbitoL47"e> */<14s529>6 47L33_dno_chsona new> /uvLr=e)2jo_chsonaL47"e> */<14s529; */<14s529;8 *4/5> m14s5a9>9 /uvLr=e)2errorL47" =i1e> */<14s529; 47L33_dno_chsona new> /uvLr=e)2jo_chsonaL47"e> */<14s529; 4/a> m14spa9clat"> o29="security4c5mmo415pp.c#9113 i91"L47" cbrddddcase="L47"bprm_set_cPRtSET_KEEP=="L kuid_7knt u PRtSET_KEEP=="LL47":class="comment"> *4/5> m14s5a9c4 /uvLr=e)2errorL47" =id_aINVALfeinhe="cINVAL option vL33_dcINVAL="lie> */<14s529;5 8 */<14s529;6 47L33_derror new> /uvLr=e)2errorL47"e> */<14s529; /uvLr=e)2errorL47" =id_aINVALfeinhe="cPERM u sion l 4(=cPERM" id,924 4/a> m14spa9; 47L33_derror new> /uvLr=e)2errorL47"e> */<14s529t; /uvLr=e)2j1-" clname="usc"> 47L33_d f_i sbito new> /uvLr=e)2 f_i sbitoL47" |=i"usc"> 47L33_dn f_i s_maskp span caknt&t9u f_i s_masketuid_SECURE_NOROOTroinhe="KEEPt=="L kuid_7knt u nt&tf 2KEEPt=="L" clae> */<14s529t */<14s529tlat"> o29="security4commo42a8.c#29112 292"L47" c="L47" c#L399 id=u f__new> 47cred new> /uvLr=e)2j1-" clname="usc"> 47L33_d f_i sbito new> /uvLr=e)2 f_i sbitoL47" &name=e~_Lcat_uid"> 47n f_i s_maskp span caknt&t9u f_i s_masketuid_SECURE_NOROOTroinhe="KEEPt=="L kuid_7knt u nt&tf 2KEEPt=="L" clae> */<14s529t4 47L33_dchsona" option vL33_dchsona"> 7"e> */<14s529t 3e5> m14>5g9t6 *4/5> m14s5a9t 8 */<14s529t /uvLr=e)2errorL47" =id_aINVALfeinhe="cNOSYL kuid_7knt u cNOSYL> 7"e> */<14s529t9 47L33_derror new> /uvLr=e)2errorL47"e> */<14s529; 4er> m13s4a9;; 4er> m13s4a9; 8 */<14s529;lat"> o29="security4commo43ca8.c#948" i93"L43" usc"> 47L33_dchsona" option vL33_dchsona"> 7":class="comment"> *4/5> m14s5a9; 47L33_dc5> it4(="amouser_nLL33_cc0c5> it4(="ametuid_SECURE_NOROOTr new> /uvLr=e)2j1-" clae> */<14s529; 3e5> m14>5g9;6 47L33_dno_chsona new> /uvLr=e)2jo_chsonaL47":class="comment"> *4/5> m14s5a9; 47L33_derror new> /uvLr=e)2errorL47":class="comment"> *4/5> m14s5a9; /uvLr=e)2j1-" clae> */<14s529;9 /uvLr=e)2errorL47"e> */<14s529> 4er> m13s4a9; 4er> m13s4a9; */<14s529> rmomm whether a j1- virtual mappliil d=)) "f6" =" 42 426 rmomm whether tarce=locaent"lof a j1- virtual mappliilby tarcc&til > 42ml3,c m14s529) 8 */<14s529> skcffe.vm_enough_memoryetuid" name="ptiux_b_fprmapmm_e name option vL33_dmm_e nameL4onfd_ol"> 47cred mm option vL33_dmm"a06" lo">m"usc"> 47L33_dpages option vL33_dpages" cla> *4/5> m14s5a9> skcffe.sys_admomL47" =id,924 4ea> m14spa9> */<14s529> skcffe.ceuss=n6" id_new> 47cred c47cred crass_c47"knt&til 4(="a06" idi &name_Lcat_uid"> 47nnit4 n/commouser_nLL33_cc0nnit4 n/comm"a06" "L47"7L 47L33_d>&kn=YS_ADMIN u sion l 4(=>&kn=YS_ADMIN="lii924 4e5t"> *<14>529> skcffe.sys_admomL47" =i1e> */<14s529>; skc_svm_enough_memory6" id_new> 47cred mm option vL33_dmm"a06" "usc"> 47L33_dpages option vL33_dpages" clid_Lcat_uid"> 47classys_admomp option v">skcffe.sys_admomL47"ae> */<14s529> {id,924<4optio45 16.c#9168 i95"L47",924 4er> m13s4a9> 4er> m13s4a9> */<14s529> */<14s529> rd=ey"3 is&funcent" arenunus" by tar=" 42 m14s529> {id,924<4optio46ap08c29p." 296"L38" class="l2Lp." 203 *> 8 */<14s529> skcffe.mmap_addr6" idunsigna"slo">m"usc"> 47L33_daddrp option v">skcaddr6" ia> *4/5> m14s5a9> 4/a> m14spa9> skcaddr6" i < "L47"bprm_set_cdac.mmap_mom_addrp option v">skcdac.mmap_mom_addr" cl+n class="comment"> *4/5> m14s5a9> skcffe.ceuss=n6" id_new> 47cred c47cred crass_c47"knt&til 4(="a06" idi &name_Lcat_uid"> 47nnit4 n/commouser_nLL33_cc0nnit4 n/comm"a06" "L47"7L 47L33_d>&kn=YS_RAWIO u sion l 4(=>&kn=YS_RAWIO="lii924 4e5t"> *<14>529> 4ea> m14spa9> 8 */<14s529>; m14>5g9> {id,924<4optio47onc.c#9388 i97"L47" cccccccccteion="a-eL38""L47"bprm_set_ce&til crass_c47"knt&til " clname="usc"> 47L33_dflagmouser_nLL33_cc0flagmL47" |=i"usc"> 47L33_dPF_SUPERPRIV kuid_7knt u PF_SUPERPRIVL47"e> */<14s529> */<14s529> 4/a> m14spa9> skcffe.mmap_ (etuid" name="ptiux_b_fprmap (p option v">skc (etuifd_ol"> 47cred (p option v">skc (etuiidunsigna"slo">m"usc"> 47L33_dreqpro optvLnssu33_ir qpro ="lii924 4e5t"> *<14>529> m"usc"> 47L33_dpro optvLnssu33_ipro ="liilunsigna"slo">m"usc"> 47L33_dflagmouser_nLL33_cc0flagmL47"a> *4/f">fnam14 4ea> m14spa9>; 4er> m13s4a9> /div> r"> parcoriginal LXR softwarenby tarc24LXR er> unity="liil3 is&experime==al v>rdnt" by 24lxr@c4mux.no="li. /div> r"> lxr.c4mux.no kindly hos6" by 24R"apill L4mpro AS="liilprovidarlof L4mux >proultliiland operaent"sLn/cvicesLnince 1995. /div>