| commit | e468016b1bd79b505e62fd410f59a03bad8bbe06 | [log] [tgz] |
|---|---|---|
| author | Stephen Smalley <sds@tycho.nsa.gov> | Tue Feb 19 13:17:38 2013 -0500 |
| committer | Stephen Smalley <sds@tycho.nsa.gov> | Tue Feb 19 13:20:55 2013 -0500 |
| tree | 93219d27935923ff1c3154926f0ecda32d17ab8f | |
| parent | 58b0fb6ddee7257a6a27f31ba97d47fa23efac15 [diff] |
zygote requires setpcap in order to drop from its bounding set. I8560fa5ad125bf31f0d13be513431697bc7d22bb changed the zygote to limit the bounding capability set to CAP_NET_RAW. This triggers a CAP_SETPCAP check by the kernel, which requires SELinux setpcap permission. Change-Id: Ib910d97dcf708273e2806e2824f4abe9fc239d6d Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>