diff --git a/[refs] b/[refs]
index 88d8bd8046e7..e91f93c0f8d0 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: d0eec99ce50baa5cc2ac02363cdb2a771ed4e1e2
+refs/heads/master: 8ec2328f1138a58eaea55ec6150985a1623b01c5
diff --git a/trunk/security/commoncap.c b/trunk/security/commoncap.c
index 302e8d0839a9..5bc1895f3f9c 100644
--- a/trunk/security/commoncap.c
+++ b/trunk/security/commoncap.c
@@ -526,6 +526,15 @@ int cap_task_kill(struct task_struct *p, struct siginfo *info,
 	if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
 		return 0;
 
+	/*
+	 * Running a setuid root program raises your capabilities.
+	 * Killing your own setuid root processes was previously
+	 * allowed.
+	 * We must preserve legacy signal behavior in this case.
+	 */
+	if (p->euid == 0 && p->uid == current->uid)
+		return 0;
+
 	/* sigcont is permitted within same session */
 	if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
 		return 0;