Messages in this thread Patch in this message | | | From | David Howells <> | Subject | Re: Q: selinux_bprm_committed_creds() && signals/do_wait | Date | Wed, 29 Apr 2009 13:42:13 +0100 |
| |
Oleg Nesterov <oleg@redhat.com> wrote:
> No need to check ->shared_pending + ->pending. We can't have SIGKILL > (shared or not) without SIGNAL_GROUP_EXIT.
Okay, I didn't realise we did this now.
How about the attached patch then?
David --- From: David Howells <dhowells@redhat.com> Subject: [PATCH] SELinux: Don't flush inherited SIGKILL during execve()
Don't flush inherited SIGKILL during execve() in SELinux's post cred commit hook. This isn't really a security problem: if the SIGKILL came before the credentials were changed, then we were right to receive it at the time, and should honour it; if it came after the creds were changed, then we definitely should honour it; and in any case, all that will happen is that the process will be scrapped before it ever returns to userspace.
Signed-off-by: David Howells <dhowells@redhat.com> ---
include/linux/sched.h | 1 + kernel/signal.c | 11 ++++++++--- security/selinux/hooks.c | 10 +++++----- 3 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h index b4c38bc..3fa82b3 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1885,6 +1885,7 @@ extern void sched_dead(struct task_struct *p); extern void proc_caches_init(void); extern void flush_signals(struct task_struct *); +extern void __flush_signals(struct task_struct *); extern void ignore_signals(struct task_struct *); extern void flush_signal_handlers(struct task_struct *, int force_default); extern int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info); diff --git a/kernel/signal.c b/kernel/signal.c index d803473..d2dd9cf 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -249,14 +249,19 @@ void flush_sigqueue(struct sigpending *queue) /* * Flush all pending signals for a task. */ +void __flush_signals(struct task_struct *t) +{ + clear_tsk_thread_flag(t, TIF_SIGPENDING); + flush_sigqueue(&t->pending); + flush_sigqueue(&t->signal->shared_pending); +} + void flush_signals(struct task_struct *t) { unsigned long flags; spin_lock_irqsave(&t->sighand->siglock, flags); - clear_tsk_thread_flag(t, TIF_SIGPENDING); - flush_sigqueue(&t->pending); - flush_sigqueue(&t->signal->shared_pending); + __flush_signals(t); spin_unlock_irqrestore(&t->sighand->siglock, flags); } diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 02c2647..76670e2 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2378,7 +2378,6 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm) struct sighand_struct *psig; u32 osid, sid; int rc, i; - unsigned long flags; osid = tsec->osid; sid = tsec->sid; @@ -2398,11 +2397,12 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm) memset(&itimer, 0, sizeof itimer); for (i = 0; i < 3; i++) do_setitimer(i, &itimer, NULL); - flush_signals(current); spin_lock_irq(¤t->sighand->siglock); - flush_signal_handlers(current, 1); - sigemptyset(¤t->blocked); - recalc_sigpending(); + if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) { + __flush_signals(current); + flush_signal_handlers(current, 1); + sigemptyset(¤t->blocked); + } spin_unlock_irq(¤t->sighand->siglock); }
| |