Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing ListSignal problem
From: Steve G <linux_4ever_at_yahoo.com>
Date: Tue, 26 Apr 2005 12:23:27 -0700 (PDT)
I ran across a problem while working on the audit code that has SE Linux implications. The function security_task_kill does not hook all paths for signal entry/delivery. Just to make sure you know the piece of code I'm talking about: http://lxr.linux.no/source/kernel/signal.c#L630 Some background -- we have a CAPP requirement to identify the sender of the TERM signal to the audit daemon. We placed a hook inside check_kill_permission(). It was called on a PPC, but my i686 kernel never sees it. I think there is some arch specific code that changes how signals are delivered on ix86. My test was simply /etc/rc.d/init.d/auditd stop and then look for a message stating the shutdown signal was received. Using strace, the usual entry method was syscall 37 (kill). After that who knows what the code path is? I'm moving the audit hook to a whole new place to solve our problem. But I thought you might want to know about this since security_task_kill appears to be not hooking signals on all platforms.
-Steve Grubb Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
-- |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |