From: Munehisa Kamata <kamatam@amazon.com>
To: <selinux@vger.kernel.org>
Cc: Munehisa Kamata <kamatam@amazon.com>
Subject: [PATCH] selinux: bring the comment about multithreaded process handling back
Date: Thu, 30 Nov 2023 00:44:53 -0800 [thread overview]
Message-ID: <20231130084453.970742-1-kamatam@amazon.com> (raw)
Since commit d9250dea3f89 ("SELinux: add boundary support and thread
context assignment"), SELinux has been supporting assigning per-thread
security context under a constraint and the comment was updated
accordingly. However, seems like commit d84f4f992cbd ("CRED: Inaugurate
COW credentials") accidentally brought the old comment back that doesn't
match what the code does.
This just brings the updated comment back and does nothing else.
Fixes: d84f4f992cbd ("CRED: Inaugurate COW credentials")
Signed-off-by: Munehisa Kamata <kamatam@amazon.com>
---
security/selinux/hooks.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 855589b64641..d147f8ac9d9d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6459,7 +6459,12 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
if (sid == 0)
goto abort_change;
- /* Only allow single threaded processes to change context */
+ /*
+ * SELinux allows to change context in the following case only.
+ * - Single threaded processes.
+ * - Multi threaded processes intend to change its context into
+ * more restricted domain (defined by TYPEBOUNDS statement).
+ */
if (!current_is_single_threaded()) {
error = security_bounded_transition(tsec->sid, sid);
if (error)
--
2.40.1
next reply other threads:[~2023-11-30 8:45 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-30 8:44 Munehisa Kamata [this message]
2023-12-05 22:44 ` [PATCH] selinux: bring the comment about multithreaded process handling back Paul Moore
2023-12-07 1:33 ` [PATCH v2] selinux: remove the wrong comment about multithreaded process handling Munehisa Kamata
2023-12-07 17:46 ` Paul Moore
2023-12-08 3:36 ` Munehisa Kamata
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231130084453.970742-1-kamatam@amazon.com \
--to=kamatam@amazon.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).