lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 18 Feb 2011 15:59:21 -0800 From: Andrew Morton <akpm@...ux-foundation.org> To: "Serge E. Hallyn" <serge@...lyn.com> Cc: LSM <linux-security-module@...r.kernel.org>, James Morris <jmorris@...ei.org>, Kees Cook <kees.cook@...onical.com>, containers@...ts.linux-foundation.org, kernel list <linux-kernel@...r.kernel.org>, "Eric W. Biederman" <ebiederm@...ssion.com>, Alexey Dobriyan <adobriyan@...il.com>, Michael Kerrisk <mtk.manpages@...il.com>, xemul@...allels.com, dhowells@...hat.com Subject: Re: [PATCH 4/9] allow killing tasks in your own or child userns On Thu, 17 Feb 2011 15:03:25 +0000 "Serge E. Hallyn" <serge@...lyn.com> wrote: > /* > + * called with RCU read lock from check_kill_permission() > + */ > +static inline int kill_ok_by_cred(struct task_struct *t) > +{ > + const struct cred *cred = current_cred(); > + const struct cred *tcred = __task_cred(t); > + > + if (cred->user->user_ns == tcred->user->user_ns && > + (cred->euid == tcred->suid || > + cred->euid == tcred->uid || > + cred->uid == tcred->suid || > + cred->uid == tcred->uid)) > + return 1; > + > + if (ns_capable(tcred->user->user_ns, CAP_KILL)) > + return 1; > + > + return 0; > +} The compiler will inline this for us. > +/* > * Bad permissions for sending the signal > * - the caller must hold the RCU read lock > */ > static int check_kill_permission(int sig, struct siginfo *info, > struct task_struct *t) > { > - const struct cred *cred, *tcred; > struct pid *sid; > int error; > > @@ -656,14 +676,8 @@ static int check_kill_permission(int sig, struct siginfo *info, > if (error) > return error; > > - cred = current_cred(); > - tcred = __task_cred(t); > if (!same_thread_group(current, t) && > - (cred->euid ^ tcred->suid) && > - (cred->euid ^ tcred->uid) && > - (cred->uid ^ tcred->suid) && > - (cred->uid ^ tcred->uid) && > - !capable(CAP_KILL)) { > + !kill_ok_by_cred(t)) { > switch (sig) { > case SIGCONT: > sid = task_session(t); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists