mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-05 20:04:19 +08:00
Return EPERM not ECHILD on security_task_wait failure
wait* syscalls return -ECHILD even when an individual PID of a live child was requested explicitly, when security_task_wait denies the operation. This means that something like a broken SELinux policy can produce an unexpected failure that looks just like a bug with wait or ptrace or something. This patch makes do_wait return -EACCES (or other appropriate error returned from security_task_wait() instead of -ECHILD if some children were ruled out solely because security_task_wait failed. [jmorris@namei.org: switch error code to EACCES] Signed-off-by: Roland McGrath <roland@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Cc: Chris Wright <chrisw@sous-sol.org> Cc: James Morris <jmorris@namei.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
906e0be197
commit
7324328446
@ -1033,6 +1033,8 @@ asmlinkage void sys_exit_group(int error_code)
|
||||
|
||||
static int eligible_child(pid_t pid, int options, struct task_struct *p)
|
||||
{
|
||||
int err;
|
||||
|
||||
if (pid > 0) {
|
||||
if (p->pid != pid)
|
||||
return 0;
|
||||
@ -1066,8 +1068,9 @@ static int eligible_child(pid_t pid, int options, struct task_struct *p)
|
||||
if (delay_group_leader(p))
|
||||
return 2;
|
||||
|
||||
if (security_task_wait(p))
|
||||
return 0;
|
||||
err = security_task_wait(p);
|
||||
if (err)
|
||||
return err;
|
||||
|
||||
return 1;
|
||||
}
|
||||
@ -1449,6 +1452,7 @@ static long do_wait(pid_t pid, int options, struct siginfo __user *infop,
|
||||
DECLARE_WAITQUEUE(wait, current);
|
||||
struct task_struct *tsk;
|
||||
int flag, retval;
|
||||
int allowed, denied;
|
||||
|
||||
add_wait_queue(¤t->signal->wait_chldexit,&wait);
|
||||
repeat:
|
||||
@ -1457,6 +1461,7 @@ repeat:
|
||||
* match our criteria, even if we are not able to reap it yet.
|
||||
*/
|
||||
flag = 0;
|
||||
allowed = denied = 0;
|
||||
current->state = TASK_INTERRUPTIBLE;
|
||||
read_lock(&tasklist_lock);
|
||||
tsk = current;
|
||||
@ -1472,6 +1477,12 @@ repeat:
|
||||
if (!ret)
|
||||
continue;
|
||||
|
||||
if (unlikely(ret < 0)) {
|
||||
denied = ret;
|
||||
continue;
|
||||
}
|
||||
allowed = 1;
|
||||
|
||||
switch (p->state) {
|
||||
case TASK_TRACED:
|
||||
/*
|
||||
@ -1570,6 +1581,8 @@ check_continued:
|
||||
goto repeat;
|
||||
}
|
||||
retval = -ECHILD;
|
||||
if (unlikely(denied) && !allowed)
|
||||
retval = denied;
|
||||
end:
|
||||
current->state = TASK_RUNNING;
|
||||
remove_wait_queue(¤t->signal->wait_chldexit,&wait);
|
||||
|
Loading…
Reference in New Issue
Block a user