linux-kernel - Re: SELinux lead to soft lockup when pid 1 proceess reap child

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhT+sU5bEKiHFXuopDfo=w8gULrxnpJW1zzdD7_wX-tzDw@mail.gmail.com>
Date:   Mon, 9 Jan 2017 18:49:36 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     Stephen Smalley <sds@...ho.nsa.gov>,
        yangshukui <yangshukui@...wei.com>
Cc:     Oleg Nesterov <oleg@...hat.com>, selinux@...ho.nsa.gov,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Kefeng Wang <wangkefeng.wang@...wei.com>,
        "Guohanjun (Hanjun Guo)" <guohanjun@...wei.com>,
        Qiang Huang <h.huangqiang@...wei.com>,
        Lizefan <lizefan@...wei.com>, "miaoxie (A)" <miaoxie@...wei.com>,
        Zhangdianfang <zhangdianfang@...wei.com>,
        Eric Paris <eparis@...isplace.org>,
        James Morris <james.l.morris@...cle.com>,
        ebiederm@...ssion.com, serge.hallyn@...ntu.com
Subject: Re: SELinux lead to soft lockup when pid 1 proceess reap child

On Mon, Jan 9, 2017 at 1:43 PM, Stephen Smalley <sds@...ho.nsa.gov> wrote:
> On Mon, 2017-01-09 at 19:29 +0100, Oleg Nesterov wrote:
>> Seriously, could someone explain why do we need the
>> security_task_wait()
>> hook at all?
>
> I would be ok with killing it.
> IIRC, the original motivation was to block an unauthorized data flow
> from child to parent when the child context differs, but part of that
> original design was also to reparent the child automatically, and that
> was never implemented.  I don't think there is a real use case for it
> in practice and it just breaks things, so let's get rid of it unless
> someone objects.

Patches are always welcome, plenty of time to get things in for 4.11 :)

-- 
paul moore
www.paul-moore.com