From 18d872f77cecec2677a394170f26aaeb08562cee Mon Sep 17 00:00:00 2001 From: Rafal Krypa Date: Mon, 4 Apr 2016 11:14:53 +0200 Subject: [PATCH 1/2] Smack: ignore null signal in smack_task_kill Kill with signal number 0 is commonly used for checking PID existence. Smack treated such cases like any other kills, although no signal is actually delivered when sig == 0. Checking permissions when sig == 0 didn't prevent an unprivileged caller from learning whether PID exists or not. When it existed, kernel returned EPERM, when it didn't - ESRCH. The only effect of policy check in such case is noise in audit logs. This change lets Smack silently ignore kill() invocations with sig == 0. Signed-off-by: Rafal Krypa Acked-by: Casey Schaufler --- security/smack/smack_lsm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 6777295f4b2b..e96080eaacbb 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2227,6 +2227,9 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, struct smack_known *tkp = smk_of_task_struct(p); int rc; + if (!sig) + return 0; /* null signal; existence test */ + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); smk_ad_setfield_u_tsk(&ad, p); /* From ece38248cfca9d1b0ba183c923f0acd2e0bf6316 Mon Sep 17 00:00:00 2001 From: Casey Schaufler Date: Thu, 7 Jul 2016 12:39:11 -0700 Subject: [PATCH 2/2] MAINTAINERS - Location of the Smack repository The Smack working tree has moved from gitorious to github. Signed-off-by: Casey Schaufler --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 7227c791004f..a296727b6ff2 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -10530,7 +10530,7 @@ SMACK SECURITY MODULE M: Casey Schaufler L: linux-security-module@vger.kernel.org W: http://schaufler-ca.com -T: git git://git.gitorious.org/smack-next/kernel.git +T: git git://github.com/cschaufler/smack-next S: Maintained F: Documentation/security/Smack.txt F: security/smack/