Commit b849a812 authored by Thomas Gleixner's avatar Thomas Gleixner
Browse files

seccomp: Use PR_SPEC_FORCE_DISABLE 



Use PR_SPEC_FORCE_DISABLE in seccomp() because seccomp does not allow to
widen restrictions.

Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent 356e4bff

kernel/seccomp.c

+1 −1
Original line number Diff line number Diff line
@@ -239,7 +239,7 @@ static inline void spec_mitigate(struct task_struct *task, 
	int state = arch_prctl_spec_ctrl_get(task, which);



	if (state > 0 && (state & PR_SPEC_PRCTL))

		arch_prctl_spec_ctrl_set(task, which, PR_SPEC_DISABLE);

		arch_prctl_spec_ctrl_set(task, which, PR_SPEC_FORCE_DISABLE);

}



static inline void seccomp_assign_mode(struct task_struct *task,