lkml.org 
[lkml]   [2006]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 2/2] SELinux: Add security hook call to mediate attach_task (kernel/cpuset.c)
From: David Quigley <dpquigl@tycho.nsa.gov>

This patch adds a security hook call to enable security modules to control
the ability to attach a task to a cpuset. While limited control over this
operation is possible via permission checks on the pseudo fs interface,
those checks are not sufficient to control access to the target task,
which is looked up in this function. The existing task_setscheduler hook
is re-used for this operation since this falls under the same class of
operations.

This is aimed at 2.6.18 inclusion to cover new code currently unmediated
by SELinux.

Please apply.

Signed-Off-By: David Quigley <dpquigl@tycho.nsa.gov>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>

---

kernel/cpuset.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff -uprN -X /home/dpquigl/dontdiff linux-2.6.17-rc6-mm2/kernel/cpuset.c linux-2.6.17-rc6-mm2-attach/kernel/cpuset.c
--- linux-2.6.17-rc6-mm2/kernel/cpuset.c 2006-06-15 09:46:28.000000000 -0400
+++ linux-2.6.17-rc6-mm2-attach/kernel/cpuset.c 2006-06-15 09:52:43.000000000 -0400
@@ -41,6 +41,7 @@
#include <linux/rcupdate.h>
#include <linux/sched.h>
#include <linux/seq_file.h>
+#include <linux/security.h>
#include <linux/slab.h>
#include <linux/smp_lock.h>
#include <linux/spinlock.h>
@@ -1177,6 +1178,7 @@ static int attach_task(struct cpuset *cs
cpumask_t cpus;
nodemask_t from, to;
struct mm_struct *mm;
+ int retval;

if (sscanf(pidbuf, "%d", &pid) != 1)
return -EIO;
@@ -1205,6 +1207,12 @@ static int attach_task(struct cpuset *cs
get_task_struct(tsk);
}

+ retval = security_task_setscheduler(tsk, 0, NULL);
+ if (retval) {
+ put_task_struct(tsk);
+ return retval;
+ }
+
mutex_lock(&callback_mutex);

task_lock(tsk);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2006-06-21 06:34    [W:0.042 / U:1.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site