All of lore.kernel.org
 help / color / mirror / Atom feed
From: James Morris <jmorris@namei.org>
To: Oleg Nesterov <oleg@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
	Roland McGrath <roland@redhat.com>,
	linux-kernel@vger.kernel.org, David Howells <dhowells@redhat.com>,
	Eric Paris <eparis@parisplace.org>,
	Alan Cox <alan@lxorguk.ukuu.org.uk>
Subject: Re: [PATCH] do_wait: do take security_task_wait() into account
Date: Fri, 1 May 2009 08:51:50 +1000 (EST)	[thread overview]
Message-ID: <alpine.LRH.2.00.0905010851270.28491@tundra.namei.org> (raw)
In-Reply-To: <20090429160123.GA4591@redhat.com>

On Wed, 29 Apr 2009, Oleg Nesterov wrote:

> I was never able to understand what should we actually do when
> security_task_wait() fails, but the current code doesn't look right.
> 
> If ->task_wait() returns the error, we update *notask_error correctly.
> But then we either reap the child (despite the fact this was forbidden)
> or clear *notask_error (and hide the securiy policy problems).
> 
> This patch assumes that "stolen by ptrace" doesn't matter. If selinux
> denies the child we should ignore it but make sure we report -EACCESS
> instead of -ECHLD if there are no other eligible children.
> 
> Signed-off-by: Oleg Nesterov <oleg@redhat.com>

Applied to: 
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next


-- 
James Morris
<jmorris@namei.org>

  parent reply	other threads:[~2009-04-30 22:53 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-04-28 22:30 Q: selinux_bprm_committed_creds() && signals/do_wait Oleg Nesterov
2009-04-28 23:33 ` Oleg Nesterov
2009-04-29 16:01   ` [PATCH] do_wait: do take security_task_wait() into account Oleg Nesterov
2009-04-30 20:31     ` Roland McGrath
2009-04-30 22:51     ` James Morris [this message]
2009-05-06 11:46       ` Stephen Smalley
2009-04-29  0:29 ` Q: selinux_bprm_committed_creds() && signals/do_wait James Morris
2009-04-29  6:58   ` Oleg Nesterov
2009-04-29 12:20     ` Stephen Smalley
2009-04-29 12:56       ` Oleg Nesterov
2009-04-29 13:16         ` Stephen Smalley
2009-04-29 13:42           ` Oleg Nesterov
2009-04-29 13:43             ` Stephen Smalley
2009-04-29 14:47           ` Alan Cox
2009-04-29 15:39             ` Stephen Smalley
2009-04-29 10:02   ` David Howells
2009-04-29 10:25     ` Oleg Nesterov
2009-04-29 11:17     ` David Howells
2009-04-29 11:55       ` Oleg Nesterov
2009-04-29 12:42       ` David Howells
2009-04-29 12:45       ` David Howells
2009-04-29 13:28         ` Oleg Nesterov
2009-04-30  0:37           ` James Morris
2009-04-29 13:18 ` Stephen Smalley
2009-04-29 13:30   ` Oleg Nesterov
2009-04-29 14:02   ` ptrace: selinux_bprm_committed_creds: simplify __wake_up_parent() code and s/parent/real_parent/ Oleg Nesterov
2009-04-29 14:08     ` Oleg Nesterov
2009-04-30 22:44       ` Roland McGrath
2009-05-03 20:10         ` Oleg Nesterov
2009-05-04 17:38           ` Roland McGrath
2009-04-30  0:38     ` James Morris
2009-04-30 22:38     ` Roland McGrath
2009-04-29 14:48 ` Q: selinux_bprm_committed_creds() && signals/do_wait Alan Cox
2009-05-01  0:02 ` Roland McGrath
2009-05-03 20:21   ` Oleg Nesterov
2009-05-04 17:34     ` Roland McGrath
2009-05-01  0:44 ` David Howells
2009-05-01  0:50   ` Roland McGrath

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.LRH.2.00.0905010851270.28491@tundra.namei.org \
    --to=jmorris@namei.org \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=dhowells@redhat.com \
    --cc=eparis@parisplace.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=oleg@redhat.com \
    --cc=roland@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.