Messages in this thread | | | Date | Thu, 2 Dec 2004 10:34:56 -0800 | From | Chris Wright <> | Subject | Re: [PATCH 4/6] Add dynamic context transition support to SELinux |
| |
* Stephen Smalley (sds@epoch.ncsc.mil) wrote: > This patch for 2.6.10-rc2-mm4 adds dynamic context transition support to SELinux via
This is nice to see.
> + /* Only allow single threaded processes to change context */ > + if (atomic_read(&p->mm->mm_users) != 1) { > + struct task_struct *g, *t; > + struct mm_struct *mm = p->mm; > + read_lock(&tasklist_lock); > + do_each_thread(g, t) > + if (t->mm == mm && t != p) { > + read_unlock(&tasklist_lock); > + return -EPERM; > + } > + while_each_thread(g, t); > + read_unlock(&tasklist_lock);
That's heavy handed. Can't you track this at clone time? Or at least do this after the AVC check, so it's not always locking task list.
thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |