linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: "Eric W. Biederman" <ebiederm@xmission.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.9 46/48] signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init
Date: Wed, 31 Oct 2018 19:10:52 -0400	[thread overview]
Message-ID: <20181031231054.29333-46-sashal@kernel.org> (raw)
In-Reply-To: <20181031231054.29333-1-sashal@kernel.org>

From: "Eric W. Biederman" <ebiederm@xmission.com>

[ Upstream commit 3597dfe01d12f570bc739da67f857fd222a3ea66 ]

Instead of playing whack-a-mole and changing SEND_SIG_PRIV to
SEND_SIG_FORCED throughout the kernel to ensure a pid namespace init
gets signals sent by the kernel, stop allowing a pid namespace init to
ignore SIGKILL or SIGSTOP sent by the kernel.  A pid namespace init is
only supposed to be able to ignore signals sent from itself and
children with SIG_DFL.

Fixes: 921cf9f63089 ("signals: protect cinit from unblocked SIG_DFL signals")
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/signal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/signal.c b/kernel/signal.c
index 4364e57e6038..424306163edc 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -991,7 +991,7 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,
 
 	result = TRACE_SIGNAL_IGNORED;
 	if (!prepare_signal(sig, t,
-			from_ancestor_ns || (info == SEND_SIG_FORCED)))
+			from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED)))
 		goto ret;
 
 	pending = group ? &t->signal->shared_pending : &t->pending;
-- 
2.17.1


  parent reply	other threads:[~2018-10-31 23:17 UTC|newest]

Thread overview: 49+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-31 23:10 [PATCH AUTOSEL 4.9 01/48] net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 02/48] locking/lockdep: Fix debug_locks off performance problem Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 03/48] ataflop: fix error handling during setup Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 04/48] swim: fix cleanup on setup error Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 05/48] tun: Consistently configure generic netdev params via rtnetlink Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 06/48] s390/sthyi: Fix machine name validity indication Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 07/48] hwmon: (pwm-fan) Set fan speed to 0 on suspend Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 08/48] perf tools: Free temporary 'sys' string in read_event_files() Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 09/48] perf tools: Cleanup trace-event-info 'tdata' leak Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 10/48] perf strbuf: Match va_{add,copy} with va_end Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 11/48] cpupower: Fix coredump on VMWare Sasha Levin
2018-11-12 10:31   ` Rafael David Tinoco
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 12/48] mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01 Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 13/48] iwlwifi: pcie: avoid empty free RB queue Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 14/48] x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 15/48] cpufreq: dt: Try freeing static OPPs only if we have added them Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 16/48] regulator: fixed: Default enable high on DT regulators Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 17/48] Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 18/48] x86: boot: Fix EFI stub alignment Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 19/48] pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 20/48] brcmfmac: fix for proper support of 160MHz bandwidth Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 21/48] kprobes: Return error if we fail to reuse kprobe instead of BUG_ON() Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 22/48] ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 23/48] pinctrl: qcom: spmi-mpp: Fix drive strength setting Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 24/48] pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 25/48] pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() " Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 26/48] ixgbevf: VF2VF TCP RSS Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 27/48] ath10k: schedule hardware restart if WMI command times out Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 28/48] cgroup, netclassid: add a preemption point to write_classid Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 29/48] scsi: esp_scsi: Track residual for PIO transfers Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 30/48] scsi: megaraid_sas: fix a missing-check bug Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 31/48] RDMA/core: Do not expose unsupported counters Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 32/48] IB/ipoib: Clear IPCB before icmp_send Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 33/48] tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 34/48] Drivers: hv: kvp: Fix two "this statement may fall through" warnings Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 35/48] VMCI: Resource wildcard match fixed Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 36/48] usb: gadget: udc: atmel: handle at91sam9rl PMC Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 37/48] ext4: fix argument checking in EXT4_IOC_MOVE_EXT Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 38/48] MD: fix invalid stored role for a disk Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 39/48] PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 40/48] coresight: etb10: Fix handling of perf mode Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 41/48] crypto: caam - fix implicit casts in endianness helpers Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 42/48] usb: chipidea: Prevent unbalanced IRQ disable Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 43/48] driver/dma/ioat: Call del_timer_sync() without holding prep_lock Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 44/48] uio: ensure class is registered before devices Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 45/48] scsi: lpfc: Correct soft lockup when running mds diagnostics Sasha Levin
2018-10-31 23:10 ` Sasha Levin [this message]
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 47/48] dmaengine: dma-jz4780: Return error if not probed from DT Sasha Levin
2018-10-31 23:10 ` [PATCH AUTOSEL 4.9 48/48] ALSA: hda: Check the non-cached stream buffers more explicitly Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181031231054.29333-46-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=ebiederm@xmission.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).