RE: [PATCH v5 3/5] SELinux: Prepare for PTRACE_MODE_SCHED

2018-09-27 Thread Schaufler, Casey
.gov; Hansen, Dave > ; Dock, Deneen T ; > kris...@linux.intel.com; ar...@linux.intel.com; Paul Moore moore.com> > Subject: Re: [PATCH v5 3/5] SELinux: Prepare for PTRACE_MODE_SCHED > > On 09/26/2018 04:34 PM, Casey Schaufler wrote: > > From: Casey Schaufler > > >

RE: [PATCH v5 3/5] SELinux: Prepare for PTRACE_MODE_SCHED

2018-09-27 Thread Schaufler, Casey
.gov; Hansen, Dave > ; Dock, Deneen T ; > kris...@linux.intel.com; ar...@linux.intel.com; Paul Moore moore.com> > Subject: Re: [PATCH v5 3/5] SELinux: Prepare for PTRACE_MODE_SCHED > > On 09/26/2018 04:34 PM, Casey Schaufler wrote: > > From: Casey Schaufler > > >

Re: [PATCH v5 3/5] SELinux: Prepare for PTRACE_MODE_SCHED

2018-09-27 Thread Stephen Smalley
On 09/26/2018 04:34 PM, Casey Schaufler wrote: From: Casey Schaufler A ptrace access check with mode PTRACE_MODE_SCHED gets called from process switching code. This precludes the use of audit or avc, as the locking is incompatible. The only available check that can be made without using avc is

Re: [PATCH v5 3/5] SELinux: Prepare for PTRACE_MODE_SCHED

2018-09-27 Thread Stephen Smalley
On 09/26/2018 04:34 PM, Casey Schaufler wrote: From: Casey Schaufler A ptrace access check with mode PTRACE_MODE_SCHED gets called from process switching code. This precludes the use of audit or avc, as the locking is incompatible. The only available check that can be made without using avc is