AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-25 12:30:55 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

selinux: selinux_bprm_committed_creds() should wake up ->real_parent, not ->parent.

Browse Source 
We shouldn't worry about the tracer if current is ptraced, exec() must not
succeed if the tracer has no rights to trace this task after cred changing.
But we should notify ->real_parent which is, well, real parent.

Also, we don't need _irq to take tasklist, and we don't need parent's
->siglock to wake_up_interruptible(real_parent->signal->wait_chldexit).
Since we hold tasklist, real_parent->signal must be stable. Otherwise
spin_lock(siglock) is not safe too and can't help anyway.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Oleg Nesterov 2009-04-29 16:02:24 +02:00 committed by James Morris
parent 3bcac0263f
commit ecd6de3c88
1 changed files with 3 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
security/selinux/hooks.c
View File

@ -2371,10 +2371,8 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
{
const struct task_security_struct *tsec = current_security();
struct itimerval itimer;
struct sighand_struct *psig;
u32 osid, sid;
int rc, i;
unsigned long flags;
osid = tsec->osid;
sid = tsec->sid;
@ -2405,12 +2403,9 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
/* Wake up the parent if it is waiting so that it can recheck
* wait permission to the new task SID. */
read_lock_irq(&tasklist_lock);
psig = current->parent->sighand;
spin_lock_irqsave(&psig->siglock, flags);
wake_up_interruptible(&current->parent->signal->wait_chldexit);
spin_unlock_irqrestore(&psig->siglock, flags);
read_unlock_irq(&tasklist_lock);
read_lock(&tasklist_lock);
wake_up_interruptible(&current->real_parent->signal->wait_chldexit);
read_unlock(&tasklist_lock);
}
/* superblock security operations */