cdrecord deadlocks linux 2.6.8.1:

I have just written selinux policy for cdrecord. While writing this policy cdrecord constantly locked up the computer (even in permissive mode). When booting with selinux=0 the problem went away.

After digging around for a while, the following seems to be happening:
* cdrecord calls sched_setscheduler()

• setscheduler (in kernel/sched.c) asks for CAP_SYS_NICE
• cdrecord doesn't have this capability
• selinux generates an audit message ==> deadlock

When I grant cdrecord CAP_SYS_NICE everything works fine. I think SELinux shouldn't generate a log message in this case; like it is already suppressed for setsched.

To test, add the attached policy, remove sys_nice from the allowed caps and simply call cdrecord without parameters.

Thomas

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



text/plain attachment: cdrecord.patch