lkml.org 
[lkml]   [2018]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.9 46/48] signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init
    Date
    From: "Eric W. Biederman" <ebiederm@xmission.com>

    [ Upstream commit 3597dfe01d12f570bc739da67f857fd222a3ea66 ]

    Instead of playing whack-a-mole and changing SEND_SIG_PRIV to
    SEND_SIG_FORCED throughout the kernel to ensure a pid namespace init
    gets signals sent by the kernel, stop allowing a pid namespace init to
    ignore SIGKILL or SIGSTOP sent by the kernel. A pid namespace init is
    only supposed to be able to ignore signals sent from itself and
    children with SIG_DFL.

    Fixes: 921cf9f63089 ("signals: protect cinit from unblocked SIG_DFL signals")
    Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/signal.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/kernel/signal.c b/kernel/signal.c
    index 4364e57e6038..424306163edc 100644
    --- a/kernel/signal.c
    +++ b/kernel/signal.c
    @@ -991,7 +991,7 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,

    result = TRACE_SIGNAL_IGNORED;
    if (!prepare_signal(sig, t,
    - from_ancestor_ns || (info == SEND_SIG_FORCED)))
    + from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED)))
    goto ret;

    pending = group ? &t->signal->shared_pending : &t->pending;
    --
    2.17.1
    \
     
     \ /
      Last update: 2018-11-01 00:18    [W:4.150 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site