lkml.org 
[lkml]   [2004]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 4/6] Add dynamic context transition support to SELinux
* Stephen Smalley (sds@epoch.ncsc.mil) wrote:
> On Thu, 2004-12-02 at 13:34, Chris Wright wrote:
> > That's heavy handed. Can't you track this at clone time? Or at least
> > do this after the AVC check, so it's not always locking task list.
>
> Hmmm...if the latter is a concern, it seems like there are other cases
> that likewise need fixing, e.g. sys_getpriority or sys_setpriority.

At least not introducing new paths.

> Earlier version of the patch did a simple check of thread_group_empty()
> but that didn't catch CLONE_VM w/o CLONE_THREAD, and simple check of
> mm_users can produce false positives, e.g. another process reading your
> /proc/pid/<xxx> file and holding a reference to the mm temporarily.

Yes, number of spots that inc mm_users, and CLONE_VM is clearly the
critical bit more so than posix thread.

> We could set a flag in the task security structure upon
> selinux_task_create upon CLONE_VM, I suppose, and inherit it in
> selinux_task_alloc_security. That would prohibit any use after you've
> ever created a thread, even if none of the other threads are still
> around, which is stronger than we need, but probably not an obstacle.
> Is that what you had in mind?

No, I was thinking of actually tracking the threads, since you know when
they come and go. One way would be to share task_security_struct via
refcnt for threads, although this could get sticky.

thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:08    [W:0.145 / U:0.384 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site