All of lore.kernel.org
 help / color / mirror / Atom feed
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: Oleg Nesterov <oleg@redhat.com>
Cc: David Howells <dhowells@redhat.com>,
	Eric Paris <eparis@parisplace.org>,
	James Morris <jmorris@namei.org>,
	Roland McGrath <roland@redhat.com>,
	Stephen Smalley <sds@tycho.nsa.gov>,
	linux-kernel@vger.kernel.org
Subject: Re: Q: selinux_bprm_committed_creds() && signals/do_wait
Date: Wed, 29 Apr 2009 15:48:31 +0100	[thread overview]
Message-ID: <20090429154831.582e7828@lxorguk.ukuu.org.uk> (raw)
In-Reply-To: <20090428223025.GA11997@redhat.com>

> But, before fixing, I'd like to understand why we are doing
> 
> 		flush_signal_handlers(current, 1);
> 		sigemptyset(&current->blocked);

Interesting - this appear to be introducing a security hole by clearing
things daemons running setuid apps are entitled to rely upon.


  parent reply	other threads:[~2009-04-29 14:49 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-04-28 22:30 Q: selinux_bprm_committed_creds() && signals/do_wait Oleg Nesterov
2009-04-28 23:33 ` Oleg Nesterov
2009-04-29 16:01   ` [PATCH] do_wait: do take security_task_wait() into account Oleg Nesterov
2009-04-30 20:31     ` Roland McGrath
2009-04-30 22:51     ` James Morris
2009-05-06 11:46       ` Stephen Smalley
2009-04-29  0:29 ` Q: selinux_bprm_committed_creds() && signals/do_wait James Morris
2009-04-29  6:58   ` Oleg Nesterov
2009-04-29 12:20     ` Stephen Smalley
2009-04-29 12:56       ` Oleg Nesterov
2009-04-29 13:16         ` Stephen Smalley
2009-04-29 13:42           ` Oleg Nesterov
2009-04-29 13:43             ` Stephen Smalley
2009-04-29 14:47           ` Alan Cox
2009-04-29 15:39             ` Stephen Smalley
2009-04-29 10:02   ` David Howells
2009-04-29 10:25     ` Oleg Nesterov
2009-04-29 11:17     ` David Howells
2009-04-29 11:55       ` Oleg Nesterov
2009-04-29 12:42       ` David Howells
2009-04-29 12:45       ` David Howells
2009-04-29 13:28         ` Oleg Nesterov
2009-04-30  0:37           ` James Morris
2009-04-29 13:18 ` Stephen Smalley
2009-04-29 13:30   ` Oleg Nesterov
2009-04-29 14:02   ` ptrace: selinux_bprm_committed_creds: simplify __wake_up_parent() code and s/parent/real_parent/ Oleg Nesterov
2009-04-29 14:08     ` Oleg Nesterov
2009-04-30 22:44       ` Roland McGrath
2009-05-03 20:10         ` Oleg Nesterov
2009-05-04 17:38           ` Roland McGrath
2009-04-30  0:38     ` James Morris
2009-04-30 22:38     ` Roland McGrath
2009-04-29 14:48 ` Alan Cox [this message]
2009-05-01  0:02 ` Q: selinux_bprm_committed_creds() && signals/do_wait Roland McGrath
2009-05-03 20:21   ` Oleg Nesterov
2009-05-04 17:34     ` Roland McGrath
2009-05-01  0:44 ` David Howells
2009-05-01  0:50   ` Roland McGrath

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20090429154831.582e7828@lxorguk.ukuu.org.uk \
    --to=alan@lxorguk.ukuu.org.uk \
    --cc=dhowells@redhat.com \
    --cc=eparis@parisplace.org \
    --cc=jmorris@namei.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=oleg@redhat.com \
    --cc=roland@redhat.com \
    --cc=sds@tycho.nsa.gov \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.