diff options
| author | Thomas Bushnell <thomas@gnu.org> | 1997-09-16 19:18:27 +0000 |
|---|---|---|
| committer | Thomas Bushnell <thomas@gnu.org> | 1997-09-16 19:18:27 +0000 |
| commit | ebec7389d6965d2ac1d940cf59f03fa5c3c3ca6e (patch) | |
| tree | 878e74b3c9f0cff6000ac65332ae7ecfdf5fe031 /libdiskfs/file-exec.c | |
| parent | 2e3dfbb0f86717b4111e81e3f2f0422926d5a29f (diff) | |
Tue Sep 16 14:37:51 1997 Thomas Bushnell, n/BSG <thomas@gnu.ai.mit.edu>
* priv.h (nosuid, noexec): New variables.
* init-init.c (nosuid, noexec): New variables, initialized to zero.
* file-exec.c (diskfs_S_file_exec): If noexec is on, then prohibit
all execution with EACCES. If nosuid is on, then prohibit setuid
or setgid execution by silently omitting the uid substitution.
* opts-std-startup.c (parse_startup_opt): Implement --no-suid and
--no-exec.
* opts-common.c (diskfs_common_options): Add --no-suid and
--no-exec.
* opts-std-runtime.c (struct parse_hook): Add nosuid and noexec.
(parse_opt) [cases 'S', 'E', OPT_SUID_OK, OPT_EXEC_OK] Understand
--no-suid, --no-exec, --suid-ok, and --exec-ok.
(parse_opt) [case ARGP_KEY_INIT]: Initialize H->nosuid and
H->noexec.
(OPT_SUID_OK, OPT_EXEC_OK): New macros.
(std_runtime_options): Add --suid-ok and --exec-ok.
(set_opts): Set nosuid and noexec from H->nosuid and H->noexec.
* opts-common.c (diskfs_common_options): Rename --nosync to
--no-sync; leave --nosync as an alias.
Diffstat (limited to 'libdiskfs/file-exec.c')
| -rw-r--r-- | libdiskfs/file-exec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libdiskfs/file-exec.c b/libdiskfs/file-exec.c index f332e700..1c6f6f70 100644 --- a/libdiskfs/file-exec.c +++ b/libdiskfs/file-exec.c @@ -71,6 +71,9 @@ diskfs_S_file_exec (struct protid *cred, gid = np->dn_stat.st_uid; mutex_unlock (&np->lock); + if (noexec) + return EACCES; + if ((cred->po->openstat & O_EXEC) == 0) return EBADF; @@ -83,7 +86,7 @@ diskfs_S_file_exec (struct protid *cred, suid = mode & S_ISUID; sgid = mode & S_ISGID; - if (suid || sgid) + if (!nosuid && (suid || sgid)) { int secure = 0; error_t get_file_ids (struct idvec *uids, struct idvec *gids) |