Messages in this thread | | | Subject | Re: [TOMOYO #12 (2.6.28-rc2-mm1) 06/11] Common functions for TOMOYOLinux. | From | Tetsuo Handa <> | Date | Mon, 10 Nov 2008 12:30:01 +0900 |
| |
Hello.
Serge E. Hallyn wrote: > > I need to clarify reachability of "struct task_struct". > > > > A process inside a virtualized environment cannot reach "struct task_struct" > > which belongs to outside the virtualized environment. > > > > A process outside virtualized environments can reach "struct task_struct" > > which belongs to inside virtualized environments, can't it? > > To be precise, there isn't a real 'inside' and 'outside' virtualized > environements. Rather pid namespaces are hierarchical. > So, processes which have non-topmost namespace cannot see processes which have topmost namespace (like chroot()). Then, it might be preferable if TOMOYO can prevent processes which have non-topmost namespace from modifying policy information. Do you think TOMOYO should do "current->nsproxy->pid_ns == &init_pid_ns" checking like below one?
static bool tomoyo_is_policy_manager(void) { struct tomoyo_policy_manager_entry *ptr; const char *exe; const struct task_struct *task = current; const struct tomoyo_path_info *domainname = tomoyo_domain()->domainname; bool found = false;
if (!tomoyo_policy_loaded) return true; if (!tomoyo_manage_by_non_root && (task->cred->uid || task->cred->euid)) return false; /* Don't allow modifying policy by processes not having init_pid_ns. */ if (task->nsproxy->pid_ns != &init_pid_ns) return false; list1_for_each_entry(ptr, &tomoyo_policy_manager_list, list) { if (!ptr->is_deleted && ptr->is_domain && !tomoyo_pathcmp(domainname, ptr->manager)) return true; }
> (Taking another look) it looks like In is_select_one() you're doing the > right thing - you look up the domain of a task based on > find_task_by_vpid() on a passed-in pid. Seems correct. > I see, thanks.
| |