Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit 291041e935e6d0513f2b7e4a300aa9f02ec1d925

Authored by Al Viro
Committed by Linus Torvalds
1 parent 7a5c5d5735
Exists in master and in 20 other branches dlt-processor-sdk-linux-03.00.00.04, newt-ti-linux-3.12.y, processor-sdk-linux-01.00.00, processor-sdk-linux-02.00.01, smarc-ti-linux-3.12.10, smarc-ti-linux-3.12.y, smarc-ti-linux-3.14.y, smarc-ti-linux-3.15.y, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04, ti-linux-3.12.y, ti-linux-3.14.y, ti-linux-3.15.y, ti-lsk-linux-4.1.y

fix bogus reporting of signals by audit 

Async signals should not be reported as sent by current in audit log.  As
it is, we call audit_signal_info() too early in check_kill_permission().
Note that check_kill_permission() has that test already - it needs to know
if it should apply current-based permission checks.  So the solution is to
move the call of audit_signal_info() between those.

Bogosity in question is easily reproduced - add a rule watching for e.g.
kill(2) from specific process (so that audit_signal_info() would not
short-circuit to nothing), say load_policy, watch the bogus OBJ_PID entry
in audit logs claiming that write(2) on selinuxfs file issued by
load_policy(8) had somehow managed to send a signal to syslogd...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Steve Grubb <sgrubb@redhat.com>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 11 additions and 11 deletions Side-by-side Diff

... ... @@ -531,18 +531,18 @@
531 531 if (!valid_signal(sig))
532 532 return error;
533 533  
534   - error = audit_signal_info(sig, t); /* Let audit system see the signal */
535   - if (error)
  534 + if (info == SEND_SIG_NOINFO || (!is_si_special(info) && SI_FROMUSER(info))) {
  535 + error = audit_signal_info(sig, t); /* Let audit system see the signal */
  536 + if (error)
  537 + return error;
  538 + error = -EPERM;
  539 + if (((sig != SIGCONT) ||
  540 + (process_session(current) != process_session(t)))
  541 + && (current->euid ^ t->suid) && (current->euid ^ t->uid)
  542 + && (current->uid ^ t->suid) && (current->uid ^ t->uid)
  543 + && !capable(CAP_KILL))
536 544 return error;
537   -
538   - error = -EPERM;
539   - if ((info == SEND_SIG_NOINFO || (!is_si_special(info) && SI_FROMUSER(info)))
540   - && ((sig != SIGCONT) ||
541   - (process_session(current) != process_session(t)))
542   - && (current->euid ^ t->suid) && (current->euid ^ t->uid)
543   - && (current->uid ^ t->suid) && (current->uid ^ t->uid)
544   - && !capable(CAP_KILL))
545   - return error;
  545 + }
546 546  
547 547 return security_task_kill(t, info, sig, 0);
548 548 }