lkml.org 
[lkml]   [2008]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] signals: check_kill_permission: check session under tasklist_lock
    Quoting Oleg Nesterov (oleg@tv-sign.ru):
    > (on top of signals-cleanup-security_task_kill-usage-implementation.patch)
    >
    > This wasn't documented, but as Atsushi Tsuji <a-tsuji@bk.jp.nec.com> pointed
    > out check_kill_permission() needs tasklist_lock for task_session_nr().
    > I missed this fact when removed tasklist from the callers.
    >
    > Change check_kill_permission() to take tasklist_lock for the SIGCONT case.
    > Re-order security checks so that we take tasklist_lock only if/when it is
    > actually needed. This is a minimal fix for now, tasklist will be removed
    > later.
    >
    > Also change the code to use task_session() instead of task_session_nr().
    >
    > Also, remove the SIGCONT check from cap_task_kill(), it is bogus (and the
    > whole function is bogus. Serge, Eric, why it is still alive?).
    >
    > Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
    >
    > --- 25/kernel/signal.c~CKP_TAKE_TASKLIST 2008-03-18 14:47:00.000000000 +0300
    > +++ 25/kernel/signal.c 2008-03-18 17:25:19.000000000 +0300
    > @@ -533,6 +533,7 @@ static int rm_from_queue(unsigned long m
    > static int check_kill_permission(int sig, struct siginfo *info,
    > struct task_struct *t)
    > {
    > + struct pid *sid;
    > int error;
    >
    > if (!valid_signal(sig))
    > @@ -545,11 +546,24 @@ static int check_kill_permission(int sig
    > if (error)
    > return error;
    >
    > - if (((sig != SIGCONT) || (task_session_nr(current) != task_session_nr(t)))
    > - && (current->euid ^ t->suid) && (current->euid ^ t->uid)
    > - && (current->uid ^ t->suid) && (current->uid ^ t->uid)
    > - && !capable(CAP_KILL))
    > - return -EPERM;
    > + if ((current->euid ^ t->suid) && (current->euid ^ t->uid) &&
    > + (current->uid ^ t->suid) && (current->uid ^ t->uid) &&
    > + !capable(CAP_KILL)) {
    > + switch (sig) {
    > + case SIGCONT:
    > + read_lock(&tasklist_lock);
    > + sid = task_session(t);
    > + read_unlock(&tasklist_lock);
    > + /*
    > + * We don't return the error if sid == NULL. The
    > + * task was unhashed, the caller must notice this.
    > + */
    > + if (!sid || sid == task_session(current))
    > + break;

    Nice, in addition to a bugfix this is also far more readable.

    > + default:
    > + return -EPERM;
    > + }
    > + }
    >
    > return security_task_kill(t, info, sig, 0);
    > }
    > --- 25/security/commoncap.c~CKP_TAKE_TASKLIST 2008-03-18 17:07:02.000000000 +0300
    > +++ 25/security/commoncap.c 2008-03-18 17:21:10.000000000 +0300
    > @@ -552,10 +552,6 @@ int cap_task_kill(struct task_struct *p,
    > if (p->uid == current->uid)
    > return 0;
    >
    > - /* sigcont is permitted within same session */
    > - if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
    > - return 0;
    > -
    > if (secid)
    > /*
    > * Signal sent as a particular user.

    Note that cap_task_kill() should be gone anyway. What tree were you
    basing this on?

    thanks,
    -serge


    \
     
     \ /
      Last update: 2008-03-20 00:39    [W:0.028 / U:177.320 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site