lkml.org 
[lkml]   [2009]   [May]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] do_wait: do take security_task_wait() into account
From
Date
On Fri, 2009-05-01 at 08:51 +1000, James Morris wrote:
> On Wed, 29 Apr 2009, Oleg Nesterov wrote:
>
> > I was never able to understand what should we actually do when
> > security_task_wait() fails, but the current code doesn't look right.
> >
> > If ->task_wait() returns the error, we update *notask_error correctly.
> > But then we either reap the child (despite the fact this was forbidden)
> > or clear *notask_error (and hide the securiy policy problems).
> >
> > This patch assumes that "stolen by ptrace" doesn't matter. If selinux
> > denies the child we should ignore it but make sure we report -EACCESS
> > instead of -ECHLD if there are no other eligible children.
> >
> > Signed-off-by: Oleg Nesterov <oleg@redhat.com>
>
> Applied to:
> git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

FWIW, I confirmed that this corrected a FAIL in the ltp selinux
testsuite (wait test).

Tested-by: Stephen Smalley <sds@tycho.nsa.gov>

--
Stephen Smalley
National Security Agency



\
 
 \ /
  Last update: 2009-05-06 13:57    [W:0.056 / U:8.240 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site