Messages in this thread | | | Date | Thu, 2 Dec 2004 11:18:59 -0800 | From | Chris Wright <> | Subject | Re: [PATCH 4/6] Add dynamic context transition support to SELinux |
| |
* Stephen Smalley (sds@epoch.ncsc.mil) wrote: > On Thu, 2004-12-02 at 13:34, Chris Wright wrote: > > That's heavy handed. Can't you track this at clone time? Or at least > > do this after the AVC check, so it's not always locking task list. > > Hmmm...if the latter is a concern, it seems like there are other cases > that likewise need fixing, e.g. sys_getpriority or sys_setpriority.
At least not introducing new paths.
> Earlier version of the patch did a simple check of thread_group_empty() > but that didn't catch CLONE_VM w/o CLONE_THREAD, and simple check of > mm_users can produce false positives, e.g. another process reading your > /proc/pid/<xxx> file and holding a reference to the mm temporarily.
Yes, number of spots that inc mm_users, and CLONE_VM is clearly the critical bit more so than posix thread.
> We could set a flag in the task security structure upon > selinux_task_create upon CLONE_VM, I suppose, and inherit it in > selinux_task_alloc_security. That would prohibit any use after you've > ever created a thread, even if none of the other threads are still > around, which is stronger than we need, but probably not an obstacle. > Is that what you had in mind?
No, I was thinking of actually tracking the threads, since you know when they come and go. One way would be to share task_security_struct via refcnt for threads, although this could get sticky.
thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |