You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Eric Paris 8a53514043 SELinux: always check SIGCHLD in selinux_task_wait ... When checking if we can wait on a child we were looking at p->exit_signal and trying to make the decision based on if the signal would eventually be allowed. One big flaw is that p->exit_signal is -1 for NPTL threads and so aignal_to_av was not actually checking SIGCHLD which is what would have been sent. Even is exit_signal was set to something strange it wouldn't change the fact that the child was there and needed to be waited on. This patch just assumes wait is based on SIGCHLD. Specific permission checks are made when the child actually attempts to send a signal. This resolves the problem of things like using GDB on confined domains such as in RH BZ 232371. The confined domain did not have permission to send a generic signal (exit_signal == -1) back to the unconfined GDB. With this patch the GDB wait works and since the actual signal sent is allowed everything functions as it should. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>		18 years ago
..
include	SELinux: policy selectable handling of unknown classes and perms	18 years ago
ss	SELinux: kills warnings in Improve SELinux performance when AVC misses	18 years ago
Kconfig	…
Makefile	…
avc.c	SELinux: Improve read/write performance	18 years ago
exports.c	…
hooks.c	SELinux: always check SIGCHLD in selinux_task_wait	18 years ago
netif.c	[NET]: Make device event notification network namespace safe	18 years ago
netlabel.c	SELinux: restore proper NetLabel caching behavior	18 years ago
netlink.c	[NET]: Support multiple network namespaces with netlink	18 years ago
nlmsgtab.c	Audit: add TTY input auditing	18 years ago
selinuxfs.c	SELinux: policy selectable handling of unknown classes and perms	18 years ago
xfrm.c	sparse pointer use of zero as null	18 years ago