1 files changed, 9 insertions, 1 deletions

diff --git a/fs/exec.c b/fs/exec.c
index b1fd2025e59a..d038968b54b4 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1245,6 +1245,13 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
                         bprm->unsafe |= LSM_UNSAFE_PTRACE;
         }
 
+        /*
+         * This isn't strictly necessary, but it makes it harder for LSMs to
+         * mess up.
+         */
+        if (current->no_new_privs)
+                bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;
+
         n_fs = 1;
         spin_lock(&p->fs->lock);
         rcu_read_lock();
@@ -1288,7 +1295,8 @@ int prepare_binprm(struct linux_binprm *bprm)
         bprm->cred->euid = current_euid();
         bprm->cred->egid = current_egid();
 
-        if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
+        if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&
+            !current->no_new_privs) {
                 /* Set-uid? */
                 if (mode & S_ISUID) {
                         bprm->per_clear |= PER_CLEAR_ON_SETID;