Initialize intercept_allow_setid to true if we use ptrace(2) and seccomp(2).

This commit is contained in:
Todd C. Miller
2022-05-04 13:32:28 -06:00
parent e84fdd99fd
commit 4ab6a87b96
11 changed files with 66 additions and 43 deletions

View File

@@ -1427,10 +1427,7 @@ exec_pty(struct command_details *details, struct command_status *cstat)
sudo_fatal("%s", U_("unable to create sockets"));
if (ISSET(details->flags, CD_INTERCEPT|CD_LOG_SUBCMDS)) {
if (have_seccomp_action("trap")) {
/* Kernel supports the seccomp(2) filter "trap" action. */
SET(details->flags, CD_USE_PTRACE);
} else {
if (!ISSET(details->flags, CD_USE_PTRACE)) {
/*
* Allocate a socketpair for communicating with sudo_intercept.so.
* This must be inherited across exec, hence no FD_CLOEXEC.