Re: Q: selinux_bprm_committed_creds() && signals/do_wait

[Oleg Nesterov <oleg@redhat.com>]

I am totally confused and almost sleeping, so another question ;)

What if eligible_child()->security_task_wait() returns the error?

wait_consider_task:

	if (unlikely(ret < 0)) {
		/*
		 * If we have not yet seen any eligible child,
		 * then let this error code replace -ECHILD.
		 * A permission error will give the user a clue
		 * to look for security policy problems, rather
		 * than for mysterious wait bugs.
		 */
		if (*notask_error)
			*notask_error = ret;
	}

But shouldn't we return 0 in this case ?

The current code proceeds and either reaps the child or clears notask_error.

Oleg.