[lkml]   [2005]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [linux-usb-devel] Re: [Security] [vendor-sec] [BUG/PATCH/RFC] Oops while completing async USB via usbdevio
* Linus Torvalds ( wrote:
> Here's a totally untested patch. It's guaranteed not to do the "right
> thing", simply because it doesn't _use_ the uid/euid information. But it's
> in the right kind of direction.
> If you change the "kill_proc_info()" into a "kill_proc_info_as_uid()"
> call, and add that to kernel/signal.c (which is basically kill_proc_info()
> except it uses the passed-in uid/euid for the "check_kill_permission()"
> tests instead), it should be correct.
> As-is, it won't work, because it will use a _random_ uid (whatever is the
> currently running process) for the kill permission. So this really is just
> a "use this as a template" kind of patch, DO NOT APPLY!

Sorry, I missed the thread up to this, but this looks fundamentally
broken. The kill_proc_info_as_uid() idea is not sufficient because more
than uid/euid are needed for permission check. There's capabilities and
security labels. Is there a reason not to do normal async here?

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-09-30 20:47    [W:0.080 / U:9.936 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site