linux/security/selinux
Eric Paris 8a53514043 SELinux: always check SIGCHLD in selinux_task_wait
When checking if we can wait on a child we were looking at
p->exit_signal and trying to make the decision based on if the signal
would eventually be allowed.  One big flaw is that p->exit_signal is -1
for NPTL threads and so aignal_to_av was not actually checking SIGCHLD
which is what would have been sent.  Even is exit_signal was set to
something strange it wouldn't change the fact that the child was there
and needed to be waited on.  This patch just assumes wait is based on
SIGCHLD.  Specific permission checks are made when the child actually
attempts to send a signal.

This resolves the problem of things like using GDB on confined domains
such as in RH BZ 232371.  The confined domain did not have permission to
send a generic signal (exit_signal == -1) back to the unconfined GDB.
With this patch the GDB wait works and since the actual signal sent is
allowed everything functions as it should.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2007-10-23 08:47:48 +10:00
..
include SELinux: policy selectable handling of unknown classes and perms 2007-10-17 08:59:33 +10:00
ss SELinux: kills warnings in Improve SELinux performance when AVC misses 2007-10-17 08:59:36 +10:00
avc.c SELinux: Improve read/write performance 2007-10-17 08:59:31 +10:00
exports.c [PATCH] selinux: rename selinux_ctxid_to_string 2006-09-26 08:48:52 -07:00
hooks.c SELinux: always check SIGCHLD in selinux_task_wait 2007-10-23 08:47:48 +10:00
Kconfig Fix trivial typos in Kconfig* files 2007-05-09 07:12:20 +02:00
Makefile SELinux: extract the NetLabel SELinux support from the security server 2007-04-26 01:35:48 -04:00
netif.c [NET]: Make device event notification network namespace safe 2007-10-10 16:49:09 -07:00
netlabel.c SELinux: restore proper NetLabel caching behavior 2007-08-02 11:52:21 -04:00
netlink.c [NET]: Support multiple network namespaces with netlink 2007-10-10 16:49:09 -07:00
nlmsgtab.c Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
selinuxfs.c SELinux: policy selectable handling of unknown classes and perms 2007-10-17 08:59:33 +10:00
xfrm.c sparse pointer use of zero as null 2007-10-18 14:37:31 -07:00