seccomp: check in_compat_syscall, not is_compat_task, in strict mode

[deliverable/linux.git] / kernel / fork.c

diff --git a/kernel/fork.c b/kernel/fork.c
index accb7221d54751ecbd8f440e89066116c3ae8586..5b8d1e7ceeeab3c396d0c83865e5ce0af72bbbe1 100644 (file)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1892,7 +1892,7 @@ static int check_unshare_flags(unsigned long unshare_flags)
        if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
                                CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
                                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET|
-                               CLONE_NEWUSER|CLONE_NEWPID))
+                               CLONE_NEWUSER|CLONE_NEWPID|CLONE_NEWCGROUP))
                return -EINVAL;
        /*
         * Not implemented, but pretend it works if there is nothing