Re: [PATCH 4/6] Add dynamic context transition support to SELinux

[Chris Wright <chrisw@osdl.org>]

* Stephen Smalley (sds@epoch.ncsc.mil) wrote:
> This patch for 2.6.10-rc2-mm4 adds dynamic context transition support to SELinux via

This is nice to see.

> +		/* Only allow single threaded processes to change context */
> +		if (atomic_read(&p->mm->mm_users) != 1) {
> +			struct task_struct *g, *t;
> +			struct mm_struct *mm = p->mm;
> +			read_lock(&tasklist_lock);
> +			do_each_thread(g, t)
> +				if (t->mm == mm && t != p) {
> +					read_unlock(&tasklist_lock);
> +					return -EPERM;
> +				}
> +			while_each_thread(g, t);
> +			read_unlock(&tasklist_lock);

That's heavy handed.  Can't you track this at clone time?  Or at least
do this after the AVC check, so it's not always locking task list.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net