From: sashiko-bot@kernel.org
Cc: linux-security-module@vger.kernel.org
Subject: Re: [RFC PATCH 2/2] fcntl: recheck signal permissions before falling back to SIGIO
Date: Sat, 07 Nov 2026 15:55:58 +0000 [thread overview]
Message-ID: <sashiko-outbox-203000@kernel.org> (raw)
In-Reply-To: <4C916018FDDAFB60+20261107154928.3519030-3-shilc2025@mail.sustech.edu.cn>
> F_SETSIG allows a file owner to request a signal other than SIGIO.
> send_sigio_to_task() checks permission for the configured signal, but
> if queuing fails, it falls back to SIGIO without checking permission
> for the fallback. Permission for the configured signal does not imply
> permission for SIGIO.
>
> Recheck permission before falling back from a different signal to
> SIGIO. Keep the existing behavior when SIGIO itself has already been
> checked.
>
> This was reproduced on x86-64 QEMU/KVM with AppArmor file signal
> mediation added: a recipient allowed a real-time signal but denied
> SIGIO reception and set RLIMIT_SIGPENDING to zero. Queuing the
> real-time signal failed, and the denied SIGIO was delivered. With this
> change, the fallback SIGIO is blocked; allowing SIGIO still permits
> fallback.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Shi Lecun <shilc2025@mail.sustech.edu.cn>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/B01DC8398B429509+20261107154928.3519030-2-shilc2025@mail.sustech.edu.cn?part=2
prev parent reply other threads:[~2026-11-07 15:55 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20261107154928.3519030-1-shilc2025@mail.sustech.edu.cn>
2026-11-07 15:49 ` [RFC PATCH 1/2] apparmor: mediate file-generated signals Shi Lecun
2026-11-07 16:00 ` sashiko-bot
2026-11-07 15:49 ` [RFC PATCH 2/2] fcntl: recheck signal permissions before falling back to SIGIO Shi Lecun
2026-11-07 15:55 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-203000@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox