lkml.org 
[lkml]   [2009]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Q: selinux_bprm_committed_creds() && signals/do_wait
    On 04/29, Stephen Smalley wrote:
    >
    > On Wed, 2009-04-29 at 08:58 +0200, Oleg Nesterov wrote:
    > >
    > > Why do we need to s/IGN/DFL/ and why do we clear ->blocked ? How this can
    > > help from the security pov?
    >
    > We don't want the caller to be able to arrange conditions that prevent
    > correct handling of signals (e.g. SIGHUP) by the callee. That was
    > motivated by a specific attack against newrole, but was a general issue
    > for any program that runs in a more trusted domain than its caller.

    Still can't understand...

    If the new image runs in a more trusted domain, then we should not change
    SIG_IGN to SIG_DFL ?

    For example, a user does "nohup setuid_app". Now, why should we change
    SIG_IGN to SIG_DFL for SIGHUP? This makes setuid_app more "vulnerable"
    to SIGHUP, not more "protected". Confused.

    OK. Since I don't understand the security magic, you can just ignore me.
    But I will appreciate any explanation for dummies ;)

    > As I recall, I based the logic in part on existing logic in
    > call_usermodehelper().

    ____call_usermodehelper() does this because we should not exec a user-space
    application with SIGKILL/SIGSTOP ignored/blocked. We don't have this problem
    when user-space execs.

    Oleg.



    \
     
     \ /
      Last update: 2009-04-29 15:03    [W:6.763 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site