Messages in this thread | | | Date | Thu, 7 May 2009 09:48:29 +1000 (EST) | From | James Morris <> | Subject | Re: [PATCH 3/3] ptrace: do not use task_lock() for attach |
| |
On Wed, 6 May 2009, Chris Wright wrote:
> * Oleg Nesterov (oleg@redhat.com) wrote: > > But this can happen without this change too? > > > > - cpu2 takes task_lock(), tracehook_tracer_task() returns NULL because > > we are not traced yet. > > > > - cpu1 does ptrace_attach() and succeds, because cpu2 didn't update sid > > yet > > > > - cpu2 continues, it doesn't check avc_has_perm() (tracer == 0) and > > updates sid. > > > > No? > > Yes. > > > Shouldn't selinux_setprocattr() take ->cred_exec_mutex, like we do in > > selinux_bprm_set_creds() path? > > I was looking at the same, seems like it to me. James?
As far as I can tell, yes.
(Added David Howells and security folk to the cc -- please make sure at least that the LSM list is cc'd when changing code which affects LSM modules).
- James -- James Morris <jmorris@namei.org>
| |