Re: dynamic context transitions

[Darrel Goeddel <dgoeddel@TrustedCS.com>]

Stephen Smalley wrote:
> Regardless of what path is chosen, some change is required to the patch
> that was proposed.   Either the kernel code needs to explicitly prohibit
> usage by multi-threaded applications or the libselinux code needs to use
> /proc/self/task/<tid>/attr/current to allow usage by multi-threaded
> applications.
> 

We are wanting to maintain the same security context for all threads of a 
process.  I was doing some investigation last night and came up with something 
like this for the setcurrent code (idea only - not compiled, will get more 
investigation):

     else if (!strcmp(name, "current")) {
         if (sid == 0)
             return -EINVAL;

+        /* Only allow the leader thread to change the context */
+        if (!thread_group_leader(p))
+            return -EPERM; /* what should we return ??? */

         /* Check permissions for the transition. */
         error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
                              PROCESS__DYNTRANSITION, NULL);
         if (error)
             return error;

         tsec->sid = sid;
+        if (!thread_group_empty(p)) {
+            /* Update the other threads in this group */
+            struct task_struct *thread = next_thread(p);
+            read_lock(&tasklist_lock);
+            while (thread != p) {
+                tsec = thread->security;
+                tsec->sid = sid;
+                thread = next_thread(thread);
+            }
+            read_unlock(&tasklist_lock);
+        }

Does this seem to be on the right track?  I will be looking more at this today. 
  I am looking to still allow multi-threaded apps to use the facility, but only 
the leader thread will have that ability.  All threads should be updated with 
the new context.

-- 

Darrel

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.