Re: Q: selinux_bprm_committed_creds() && signals/do_wait

[Oleg Nesterov]

On 04/29, Stephen Smalley wrote:
>
> On Wed, 2009-04-29 at 08:58 +0200, Oleg Nesterov wrote:
> >
> > Why do we need to s/IGN/DFL/ and why do we clear ->blocked ? How this can
> > help from the security pov?
>
> We don't want the caller to be able to arrange conditions that prevent
> correct handling of signals (e.g. SIGHUP) by the callee.  That was
> motivated by a specific attack against newrole, but was a general issue
> for any program that runs in a more trusted domain than its caller.

Still can't understand...

If the new image runs in a more trusted domain, then we should not change
SIG_IGN to SIG_DFL ?

For example, a user does "nohup setuid_app". Now, why should we change
SIG_IGN to SIG_DFL for SIGHUP? This makes setuid_app more "vulnerable"
to SIGHUP, not more "protected". Confused.

OK. Since I don't understand the security magic, you can just ignore me.
But I will appreciate any explanation for dummies ;)

> As I recall, I based the logic in part on existing logic in
> call_usermodehelper().

____call_usermodehelper() does this because we should not exec a user-space
application with SIGKILL/SIGSTOP ignored/blocked. We don't have this problem
when user-space execs.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/