Messages in this thread Patch in this message | | | From | Rafal Krypa <> | Subject | [PATCH] Smack: ignore null signal in smack_task_kill | Date | Mon, 04 Apr 2016 11:14:53 +0200 |
| |
Kill with signal number 0 is commonly used for checking PID existence. Smack treated such cases like any other kills, although no signal is actually delivered when sig == 0.
Checking permissions when sig == 0 didn't prevent an unprivileged caller from learning whether PID exists or not. When it existed, kernel returned EPERM, when it didn't - ESRCH. The only effect of policy check in such case is noise in audit logs.
This change lets Smack silently ignore kill() invocations with sig == 0.
Signed-off-by: Rafal Krypa <r.krypa@samsung.com> --- security/smack/smack_lsm.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 11f7901..3d9bbed 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2227,6 +2227,9 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, struct smack_known *tkp = smk_of_task_struct(p); int rc; + if (!sig) + return 0; /* null signal; existence test */ + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); smk_ad_setfield_u_tsk(&ad, p); /* -- 2.8.0.rc3
| |