mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Shayon Mukherjee
27f11cc665
When a non-privileged user writes to a file on tmpfs, Linux clears both the setuid/setgid mode bits and the security.capability xattr via file_remove_privs. The mode bit clearing was already implemented through ClearSUIDAndSGID, but the xattr removal was missing, so file capabilities survived content replacement. An unprivileged user could overwrite a capability-bearing binary and execute it with the retained privileges. Fixes #13063