lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 17 Jul 2014 10:53:40 -0700 From: Andy Lutomirski <luto@...capital.net> To: Kees Cook <keescook@...omium.org> Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, LSM List <linux-security-module@...r.kernel.org>, James Morris <jmorris@...ei.org>, Oleg Nesterov <oleg@...hat.com>, David Drysdale <drysdale@...gle.com> Subject: Re: [PATCH] seccomp: do not reject initial filter using TSYNC On Thu, Jul 17, 2014 at 10:49 AM, Kees Cook <keescook@...omium.org> wrote: > There was an unneeded sanity check in the TSYNC code that was causing > the first filter applied to not allow the TSYNC flag. Additionally, > this optimizes the thread loops to skip "current". It was harmless, but > better to not cause problems in the future. > > Reported-by: David Drysdale <drysdale@...gle.com> > Signed-off-by: Kees Cook <keescook@...omium.org> > --- > This goes on top of the v11 seccomp-tsync series. If I should respin > as v12, please let me know. > > Thanks! > --- > kernel/seccomp.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > > diff --git a/kernel/seccomp.c b/kernel/seccomp.c > index 2125b83ccfd4..0e0c6905b81d 100644 > --- a/kernel/seccomp.c > +++ b/kernel/seccomp.c > @@ -255,14 +255,15 @@ static inline pid_t seccomp_can_sync_threads(void) > BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); > BUG_ON(!spin_is_locked(¤t->sighand->siglock)); > > - if (current->seccomp.mode != SECCOMP_MODE_FILTER) > - return -EACCES; > - > /* Validate all threads being eligible for synchronization. */ > caller = current; > for_each_thread(caller, thread) { > pid_t failed; > > + /* Skip current, since it is initiating the sync. */ > + if (thread == current) > + continue; > + Should that be "thread == caller"? --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists