Messages in this thread | | | Date | Wed, 29 Apr 2009 15:28:44 +0200 | From | Oleg Nesterov <> | Subject | Re: Q: selinux_bprm_committed_creds() && signals/do_wait |
| |
On 04/29, David Howells wrote: > > From: David Howells <dhowells@redhat.com> > Subject: [PATCH] SELinux: Don't flush inherited SIGKILL during execve() > > Don't flush inherited SIGKILL during execve() in SELinux's post cred commit > hook. This isn't really a security problem: if the SIGKILL came before the > credentials were changed, then we were right to receive it at the time, and > should honour it; if it came after the creds were changed, then we definitely > should honour it; and in any case, all that will happen is that the process > will be scrapped before it ever returns to userspace. > > Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
| |