Rafal Krypa 18d872f77c Smack: ignore null signal in smack_task_kill ...

Kill with signal number 0 is commonly used for checking PID existence.
Smack treated such cases like any other kills, although no signal is
actually delivered when sig == 0.

Checking permissions when sig == 0 didn't prevent an unprivileged caller
from learning whether PID exists or not. When it existed, kernel returned
EPERM, when it didn't - ESRCH. The only effect of policy check in such
case is noise in audit logs.

This change lets Smack silently ignore kill() invocations with sig == 0.

Signed-off-by: Rafal Krypa <r.krypa@samsung.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>

2016-06-08 13:52:31 -07:00

..

Kconfig

Smack: secmark support for netfilter

2015-01-20 16:34:25 -08:00

Makefile

Smack: Repair netfilter dependency

2015-01-23 10:08:19 -08:00

smack_access.c

Smack: limited capability for changing process label

2015-10-19 12:06:47 -07:00

smack_lsm.c

Smack: ignore null signal in smack_task_kill

2016-06-08 13:52:31 -07:00

smack_netfilter.c

smack: use skb_to_full_sk() helper

2015-11-08 20:56:38 -05:00

smack.h

Smack: limited capability for changing process label

2015-10-19 12:06:47 -07:00

smackfs.c

convert a bunch of open-coded instances of memdup_user_nul()

2016-01-04 10:26:58 -05:00