Re: Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message?
On 14/03/11, Eric Paris wrote:
On Tue, 2014-03-11 at 18:15 -0400, Richard Guy Briggs wrote:
> Steve,
>
> Subject says it all...
>
> Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message?
No...
Given that userspace requests AUDIT_SIGNAL_INFO after it gets a signal,
and that audit_sig_{uid,pid,...} get filled in when some task sent
auditd that signal, the idea that the pid would be 0 doesn't make
sense... (unless auditd requests AUDIT_SIGNAL_INFO without getting a
signal, but that's just dumb)
The reason I ask is that it is initialized to -1, which I assume is no
more valid than zero in your interpretation above.
I looked at converting audit_sig_pid from pid_t to struct pid *, but
then get_pid() would also be needed to protect that reference. A
put_pid() would need to be done once it is no longer needed, which could
be immediately after it is read in the AUDIT_SIGNAL_INFO message
preparation, assuming it would never need to be read again. If this
isn't the case, put_pid() could be called when audit_pid is nulled, but
if that message never comes, that struct pid is stuck with a stale
refcount. (That isn't an issue if it is init or systemd, but it is
still wrong.)
This looks more and more like overkill and should probably leave
audit_sig_pid as pid_t.
- RGB
--
Richard Guy Briggs <rbriggs(a)redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545