Re: [PATCH 4/6] Add dynamic context transition support to SELinux

[Chris Wright <chrisw@osdl.org>]

* Stephen Smalley (sds@epoch.ncsc.mil) wrote:
> On Thu, 2004-12-02 at 13:34, Chris Wright wrote:
> > That's heavy handed.  Can't you track this at clone time?  Or at least
> > do this after the AVC check, so it's not always locking task list.
> 
> Hmmm...if the latter is a concern, it seems like there are other cases
> that likewise need fixing, e.g. sys_getpriority or sys_setpriority. 

At least not introducing new paths.

> Earlier version of the patch did a simple check of thread_group_empty()
> but that didn't catch CLONE_VM w/o CLONE_THREAD, and simple check of
> mm_users can produce false positives, e.g. another process reading your
> /proc/pid/<xxx> file and holding a reference to the mm temporarily.

Yes, number of spots that inc mm_users, and CLONE_VM is clearly the
critical bit more so than posix thread.

> We could set a flag in the task security structure upon
> selinux_task_create upon CLONE_VM, I suppose, and inherit it in
> selinux_task_alloc_security.  That would prohibit any use after you've
> ever created a thread, even if none of the other threads are still
> around, which is stronger than we need, but probably not an obstacle. 
> Is that what you had in mind?

No, I was thinking of actually tracking the threads, since you know when
they come and go.  One way would be to share task_security_struct via
refcnt for threads, although this could get sticky.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net