Messages in this thread | | | Date | Wed, 29 Apr 2009 14:56:06 +0200 | From | Oleg Nesterov <> | Subject | Re: Q: selinux_bprm_committed_creds() && signals/do_wait |
| |
On 04/29, Stephen Smalley wrote: > > On Wed, 2009-04-29 at 08:58 +0200, Oleg Nesterov wrote: > > > > Why do we need to s/IGN/DFL/ and why do we clear ->blocked ? How this can > > help from the security pov? > > We don't want the caller to be able to arrange conditions that prevent > correct handling of signals (e.g. SIGHUP) by the callee. That was > motivated by a specific attack against newrole, but was a general issue > for any program that runs in a more trusted domain than its caller.
Still can't understand...
If the new image runs in a more trusted domain, then we should not change SIG_IGN to SIG_DFL ?
For example, a user does "nohup setuid_app". Now, why should we change SIG_IGN to SIG_DFL for SIGHUP? This makes setuid_app more "vulnerable" to SIGHUP, not more "protected". Confused.
OK. Since I don't understand the security magic, you can just ignore me. But I will appreciate any explanation for dummies ;)
> As I recall, I based the logic in part on existing logic in > call_usermodehelper().
____call_usermodehelper() does this because we should not exec a user-space application with SIGKILL/SIGSTOP ignored/blocked. We don't have this problem when user-space execs.
Oleg.
| |