From: sashiko-bot@kernel.org
Cc: linux-security-module@vger.kernel.org
Subject: Re: [RFC PATCH 2/2] fcntl: recheck signal permissions before falling back to SIGIO
Date: Sat, 07 Nov 2026 15:55:58 +0000 [thread overview]
Message-ID: <sashiko-outbox-203000@kernel.org> (raw)
In-Reply-To: <4C916018FDDAFB60+20261107154928.3519030-3-shilc2025@mail.sustech.edu.cn>
> F_SETSIG allows a file owner to request a signal other than SIGIO.
> send_sigio_to_task() checks permission for the configured signal, but
> if queuing fails, it falls back to SIGIO without checking permission
> for the fallback. Permission for the configured signal does not imply
> permission for SIGIO.
>
> Recheck permission before falling back from a different signal to
> SIGIO. Keep the existing behavior when SIGIO itself has already been
> checked.
>
> This was reproduced on x86-64 QEMU/KVM with AppArmor file signal
> mediation added: a recipient allowed a real-time signal but denied
> SIGIO reception and set RLIMIT_SIGPENDING to zero. Queuing the
> real-time signal failed, and the denied SIGIO was delivered. With this
> change, the fallback SIGIO is blocked; allowing SIGIO still permits
> fallback.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Shi Lecun <shilc2025@mail.sustech.edu.cn>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/B01DC8398B429509+20261107154928.3519030-2-shilc2025@mail.sustech.edu.cn?part=2
prev parent reply other threads:[~2026-11-07 15:55 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20261107154928.3519030-1-shilc2025@mail.sustech.edu.cn>
2026-11-07 15:49 ` [RFC PATCH 1/2] apparmor: mediate file-generated signals Shi Lecun
2026-11-07 16:00 ` sashiko-bot
2026-11-07 15:49 ` [RFC PATCH 2/2] fcntl: recheck signal permissions before falling back to SIGIO Shi Lecun
2026-11-07 15:55 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-203000@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.