1. 22 Oct, 2007 1 commit
    • Eric Paris's avatar
      SELinux: always check SIGCHLD in selinux_task_wait · 8a535140
      Eric Paris authored
      When checking if we can wait on a child we were looking at
      p->exit_signal and trying to make the decision based on if the signal
      would eventually be allowed.  One big flaw is that p->exit_signal is -1
      for NPTL threads and so aignal_to_av was not actually checking SIGCHLD
      which is what would have been sent.  Even is exit_signal was set to
      something strange it wouldn't change the fact that the child was there
      and needed to be waited on.  This patch just assumes wait is based on
      SIGCHLD.  Specific permission checks are made when the child actually
      attempts to send a signal.
      
      This resolves the problem of things like using GDB on confined domains
      such as in RH BZ 232371.  The confined domain did not have permission to
      send a generic signal (exit_signal == -1) back to the unconfined GDB.
      With this patch the GDB wait works and since the actual signal sent is
      allowed everything functions as it should.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      8a535140
  2. 21 Oct, 2007 29 commits
  3. 20 Oct, 2007 10 commits