From: Oleg Nesterov <oleg@redhat.com>
To: David Howells <dhowells@redhat.com>
Cc: James Morris <jmorris@namei.org>,
Eric Paris <eparis@parisplace.org>,
Roland McGrath <roland@redhat.com>,
Stephen Smalley <sds@tycho.nsa.gov>,
linux-kernel@vger.kernel.org
Subject: Re: Q: selinux_bprm_committed_creds() && signals/do_wait
Date: Wed, 29 Apr 2009 13:55:50 +0200 [thread overview]
Message-ID: <20090429115550.GA25368@redhat.com> (raw)
In-Reply-To: <7150.1241003840@redhat.com>
On 04/29, David Howells wrote:
>
> Oleg Nesterov <oleg@redhat.com> wrote:
>
> > > I suspect we should pass SIGKILL
> >
> > Or we can fliter out SIGKILLs, yes.
>
> How about the attached patch?
Heh. I did the very similar patch. It wasn't sent because I'd like to
understand flush_signal_handlers + sigemptyset first.
But,
> @@ -2398,11 +2398,14 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
> memset(&itimer, 0, sizeof itimer);
> for (i = 0; i < 3; i++)
> do_setitimer(i, &itimer, NULL);
> - flush_signals(current);
> spin_lock_irq(¤t->sighand->siglock);
> - flush_signal_handlers(current, 1);
> - sigemptyset(¤t->blocked);
> - recalc_sigpending();
> + if (!sigismember(¤t->pending.signal, SIGKILL) &&
> + !sigismember(¤t->signal->shared_pending.signal,
> + SIGKILL)) {
No, no. Just
if (!(current->signal->flags & SIGNAL_GROUP_EXIT))
__flush_signals();
is enough and more clean imho. The fact that we _really_ have the pending
SIGKILL is just the implementation detail (and perhaps this we be changed
eventually).
No need to check ->shared_pending + ->pending. We can't have SIGKILL
(shared or not) without SIGNAL_GROUP_EXIT.
Oleg.
next prev parent reply other threads:[~2009-04-29 12:00 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-04-28 22:30 Q: selinux_bprm_committed_creds() && signals/do_wait Oleg Nesterov
2009-04-28 23:33 ` Oleg Nesterov
2009-04-29 16:01 ` [PATCH] do_wait: do take security_task_wait() into account Oleg Nesterov
2009-04-30 20:31 ` Roland McGrath
2009-04-30 22:51 ` James Morris
2009-05-06 11:46 ` Stephen Smalley
2009-04-29 0:29 ` Q: selinux_bprm_committed_creds() && signals/do_wait James Morris
2009-04-29 6:58 ` Oleg Nesterov
2009-04-29 12:20 ` Stephen Smalley
2009-04-29 12:56 ` Oleg Nesterov
2009-04-29 13:16 ` Stephen Smalley
2009-04-29 13:42 ` Oleg Nesterov
2009-04-29 13:43 ` Stephen Smalley
2009-04-29 14:47 ` Alan Cox
2009-04-29 15:39 ` Stephen Smalley
2009-04-29 10:02 ` David Howells
2009-04-29 10:25 ` Oleg Nesterov
2009-04-29 11:17 ` David Howells
2009-04-29 11:55 ` Oleg Nesterov [this message]
2009-04-29 12:42 ` David Howells
2009-04-29 12:45 ` David Howells
2009-04-29 13:28 ` Oleg Nesterov
2009-04-30 0:37 ` James Morris
2009-04-29 13:18 ` Stephen Smalley
2009-04-29 13:30 ` Oleg Nesterov
2009-04-29 14:02 ` ptrace: selinux_bprm_committed_creds: simplify __wake_up_parent() code and s/parent/real_parent/ Oleg Nesterov
2009-04-29 14:08 ` Oleg Nesterov
2009-04-30 22:44 ` Roland McGrath
2009-05-03 20:10 ` Oleg Nesterov
2009-05-04 17:38 ` Roland McGrath
2009-04-30 0:38 ` James Morris
2009-04-30 22:38 ` Roland McGrath
2009-04-29 14:48 ` Q: selinux_bprm_committed_creds() && signals/do_wait Alan Cox
2009-05-01 0:02 ` Roland McGrath
2009-05-03 20:21 ` Oleg Nesterov
2009-05-04 17:34 ` Roland McGrath
2009-05-01 0:44 ` David Howells
2009-05-01 0:50 ` Roland McGrath
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090429115550.GA25368@redhat.com \
--to=oleg@redhat.com \
--cc=dhowells@redhat.com \
--cc=eparis@parisplace.org \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=roland@redhat.com \
--cc=sds@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.