lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAGXu5j+d38Uy=Rwjrt4NFjEgWZ13djFdF_RWHVPKAMnDn9YTVw@mail.gmail.com> Date: Thu, 17 Jul 2014 10:56:36 -0700 From: Kees Cook <keescook@...omium.org> To: Andy Lutomirski <luto@...capital.net> Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, LSM List <linux-security-module@...r.kernel.org>, James Morris <jmorris@...ei.org>, Oleg Nesterov <oleg@...hat.com>, David Drysdale <drysdale@...gle.com> Subject: Re: [PATCH] seccomp: do not reject initial filter using TSYNC On Thu, Jul 17, 2014 at 10:53 AM, Andy Lutomirski <luto@...capital.net> wrote: > On Thu, Jul 17, 2014 at 10:49 AM, Kees Cook <keescook@...omium.org> wrote: >> There was an unneeded sanity check in the TSYNC code that was causing >> the first filter applied to not allow the TSYNC flag. Additionally, >> this optimizes the thread loops to skip "current". It was harmless, but >> better to not cause problems in the future. >> >> Reported-by: David Drysdale <drysdale@...gle.com> >> Signed-off-by: Kees Cook <keescook@...omium.org> >> --- >> This goes on top of the v11 seccomp-tsync series. If I should respin >> as v12, please let me know. >> >> Thanks! >> --- >> kernel/seccomp.c | 11 ++++++++--- >> 1 file changed, 8 insertions(+), 3 deletions(-) >> >> diff --git a/kernel/seccomp.c b/kernel/seccomp.c >> index 2125b83ccfd4..0e0c6905b81d 100644 >> --- a/kernel/seccomp.c >> +++ b/kernel/seccomp.c >> @@ -255,14 +255,15 @@ static inline pid_t seccomp_can_sync_threads(void) >> BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); >> BUG_ON(!spin_is_locked(¤t->sighand->siglock)); >> >> - if (current->seccomp.mode != SECCOMP_MODE_FILTER) >> - return -EACCES; >> - >> /* Validate all threads being eligible for synchronization. */ >> caller = current; >> for_each_thread(caller, thread) { >> pid_t failed; >> >> + /* Skip current, since it is initiating the sync. */ >> + if (thread == current) >> + continue; >> + > > Should that be "thread == caller"? caller shouldn't be changing, correct? Won't it be the same? -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists