Return-path: Received: from localhost ([127.0.0.1] helo=nanos.tec.linutronix.de) by Galois.linutronix.de with esmtp (Exim 4.80) (envelope-from ) id 1fEjlZ-0004hK-OL for speck@linutronix.de; Sat, 05 May 2018 01:05:29 +0200 Message-Id: <20180504225931.710800915@linutronix.de> Date: Sat, 05 May 2018 00:57:15 +0200 From: Thomas Gleixner References: <20180504225712.642297382@linutronix.de> MIME-Version: 1.0 Subject: [patch V2 3/6] SSB update 3 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit To: speck@linutronix.de List-ID: Use PR_SPEC_FORCE_DISABLE in seccomp() because seccomp does not allow to widen restrictions. Signed-off-by: Thomas Gleixner --- kernel/seccomp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -239,7 +239,7 @@ static inline void spec_mitigate(struct int state = arch_prctl_spec_ctrl_get(task, which); if (state > 0 && (state & PR_SPEC_PRCTL)) - arch_prctl_spec_ctrl_set(task, which, PR_SPEC_DISABLE); + arch_prctl_spec_ctrl_set(task, which, PR_SPEC_FORCE_DISABLE); } static inline void seccomp_assign_mode(struct task_struct *task,