[lkml]   [2005]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [linux-usb-devel] Re: [Security] [vendor-sec] [BUG/PATCH/RFC] Oops while completing async USB via usbdevio
    * Linus Torvalds ( wrote:
    > Here's a totally untested patch. It's guaranteed not to do the "right
    > thing", simply because it doesn't _use_ the uid/euid information. But it's
    > in the right kind of direction.
    > If you change the "kill_proc_info()" into a "kill_proc_info_as_uid()"
    > call, and add that to kernel/signal.c (which is basically kill_proc_info()
    > except it uses the passed-in uid/euid for the "check_kill_permission()"
    > tests instead), it should be correct.
    > As-is, it won't work, because it will use a _random_ uid (whatever is the
    > currently running process) for the kill permission. So this really is just
    > a "use this as a template" kind of patch, DO NOT APPLY!

    Sorry, I missed the thread up to this, but this looks fundamentally
    broken. The kill_proc_info_as_uid() idea is not sufficient because more
    than uid/euid are needed for permission check. There's capabilities and
    security labels. Is there a reason not to do normal async here?

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-09-30 20:47    [W:0.021 / U:14.816 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site